Authentication flaw

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03...

Remote code execution

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01...

Open redirect

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04...

Open redirect

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02...

CVE-2018-15483

CVE-2018-15483 affects KONE Group Controller (KGC) devices prior to 4.6.5. The issue enables Denial of Service via the open HTTP interface (KONE-04). Descriptions in connected sources confirm affected product/class and the vulnerability class, but there is no explicit remediation or in‑the‑wild e...

CVE-2018-15486

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02...

CVE-2018-15485

CVE-2018-15485 – KONE Group Controller (KGC) affects KGC devices before 4.6.5. The issue is that the FTP service does not require authentication or authorization, allowing unauthenticated access. According to NVD, this yields a high-impact potential for confidentiality and integrity (CVSS3: Criti...

CVE-2018-15483

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Denial of Service can occur through the open HTTP interface, aka KONE-04...

CVE-2018-15486

The CVE-2018-15486 entry concerns KONE Group Controller (KGC) devices prior to version 4.6.5. The vulnerability enables Una uthenticated Local File Inclusion and file modification via the open HTTP interface by altering the name parameter of the file endpoint (aka KONE-02). This could impact conf...

CVE-2018-15484

The CVE-2018-15484 entry affects KONE Group Controller (KGC) devices prior to 4.6.5. The issue allows unauthenticated remote code execution via the open HTTP interface by modifying autoexec.bat (aka KONE-01). Impact is high: attacker can achieve remote code execution with network access and no pr...

CVE-2018-15485

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. FTP does not require authentication or authorization, aka KONE-03...

CVE-2018-15484

An issue was discovered on KONE Group Controller KGC devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat, aka KONE-01...

KONE KGC 4.6.4 - Multiple Vulnerabilities

KONE KGC versions 4.6.4 and below suffer from unauthenticated remote code execution, denial of service, local file inclusion, and missing FTP access control vulnerabilities. Vulnerabilities in KONEs Group Controller KGC -------------------------------------------------------------------------...

KONE KGC 4.6.4 DoS / Code Execution / LFI / Bypass

Vulnerabilities in KONEs Group Controller KGC ------------------------------------------------------------------------- Introduction ============ Vulnerabilities were identified in the KONE Group Controller KGC. These were discovered during a black box assessment and therefore the vulnerability...

kone-store.com XSS vulnerability

Open Bug Bounty ID: OBB-566164 Description| Value ---|--- Affected Website:| kone-store.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Unfixed XSS vulnerability at kone-liga.ru

Security researcher PaPPy, has submitted on 15/05/2008 a cross-site-scripting XSS vulnerability affecting kone-liga.ru, which at the time of submission ranked 10187321 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/05/2008. It is currently...