Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2010-0436

kdm privilege escalation flaw

Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Kde Redhat
Products
Kde Sc Enterprise Linux
CVE-2010-0923

kdebase: race condition may allow local attackers to bypass screen locking

Race condition in workspace/krunner/lock/lockdlg.cc in the KRunner lock module in kdebase in KDE SC 4.4.0 allows physically proximate attackers to bypass KScreenSaver screen locking and access an unattended workstation by pressing the Enter key at a certain time, related to multiple forked processes.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Kde
Products
Kde Sc
CVE-2010-1000

kdenetwork: improper sanitization of metalink attribute for downloading files

Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.

CVSS 2.0 · 5.8 Medium EPSS 3.8% KEV · Not listed
Vendors
Kde
Products
Kde Sc
CVE-2010-1511

kdenetwork: improper sanitization of metalink attribute for downloading files

KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.

CVSS 2.0 · 6.4 Medium EPSS 3.3% KEV · Not listed
Vendors
Kde
Products
Kde Sc Kget
CVE-2010-2575

kdegraphics: a boundary error in Okular

Heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp in Okular in KDE SC 4.3.0 through 4.5.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image in a PDB file.

CVSS 2.0 · 6.8 Medium EPSS 4.7% KEV · Not listed
Vendors
Kde
Products
Kde Sc
CVE-2011-1168

kdelibs: partially universal XSS in Konqueror error pages

Cross-site scripting (XSS) vulnerability in the KHTMLPart::htmlError function in khtml/khtml_part.cpp in Konqueror in KDE SC 4.4.0 through 4.6.1 allows remote attackers to inject arbitrary web script or HTML via the URI in a URL corresponding to an unavailable web site.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Kde Redhat
Products
Kde Sc Enterprise Linux
CVE-2011-1586

kdenetwork: incomplete fix for CVE-2010-1000

Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000.

CVSS 2.0 · 5.8 Medium EPSS 3.1% KEV · Not listed
Vendors
Kde Redhat
Products
Kde Sc Enterprise Linux
CVE-2011-2725

kdeutils: Ark path traversal

Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.

CVSS 2.0 · 6.8 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Kde Opensuse
Products
Ubuntu Linux Ark Kde Sc and 1 more
CVE-2011-3365

kdelibs: input validation failure in KSSL

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

CVSS 2.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Kde Redhat
Products
Kde Sc Enterprise Linux
CVE-2013-4132

kde-workspace: NULL pointer dereference in KDM and KCheckPass when glibc 2.17 or FIPS-140 enabled system used

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.

CVSS 2.0 · 5.0 Medium EPSS 2.4% KEV · Not listed
Vendors
Kde Opensuse
Products
Kde-workspace Kde Sc Opensuse