Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2009-2702

kdelibs: kssl incorrect verification of SSL certificate with NUL in subjectAltName

KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Kde
Products
Kdelibs
CVE-2003-0459

security flaw

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Kde Redhat
Products
Konqueror Konqueror Embedded Analog Real-time Synthesizer and 7 more
CVE-2004-1165

security flaw

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Kde Redhat
Products
Kdelibs Konqueror Enterprise Linux
CVE-2017-8422

kauth: service invoking dbus is not properly checked and allows local privilege escalation

KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app.

CVSS 3.0 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Kde Redhat
Products
Kauth Kdelibs Enterprise Linux
CVE-2015-7543

arts,kdelibs3: Use of mktemp(3) allows attacker to hijack the IPC

aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Artsproject Kde
Products
Arts Kdelibs
CVE-2017-6410

kdelibs: Information Leak when accessing https when using a malicious PAC file

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kde
Products
Kdelibs Kio
CVE-2014-3494

kdelibs: POP3 kioslave silently accepted invalid SSL certificates

kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kde Opensuse
Products
Kdelibs Opensuse
CVE-2014-5033

polkit-qt: insecure calling of polkit

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Kde and 1 more
Products
Ubuntu Linux Kde4libs Kauth and 2 more
CVE-2013-2074

kdelibs: prints passwords contained in HTTP URLs in error messages

kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Kde
Products
Kdelibs