Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2006-4811

security flaw

Integer overflow in Qt 3.3 before 3.3.7, 4.1 before 4.1.5, and 4.2 before 4.2.1, as used in the KDE khtml library, kdelibs 3.1.3, and possibly other packages, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted pixmap image.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed
Vendors
Qt Redhat
Products
Qt Enterprise Linux Kdelibs
CVE-2003-0459

security flaw

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Kde Redhat
Products
Konqueror Konqueror Embedded Analog Real-time Synthesizer and 7 more
CVE-2004-1165

security flaw

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Kde Redhat
Products
Kdelibs Konqueror Enterprise Linux
CVE-2017-8422

kauth: service invoking dbus is not properly checked and allows local privilege escalation

KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app.

CVSS 3.0 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Kde Redhat
Products
Kauth Kdelibs Enterprise Linux
CVE-2014-5033

polkit-qt: insecure calling of polkit

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Kde and 1 more
Products
Ubuntu Linux Kde4libs Kauth and 2 more
CVE-2011-1094

kdelibs: SSL certificate for IP address accepted as valid for hosts that resolve to the IP

kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Kdelibs