CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11880
https://notcve.org/view.php?id=CVE-2020-11880
17 Apr 2020 — An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value. Se detectó un problema en KDE KMail versiones anteriores a 19.12.3. Al usar el parámetro "mailto? • https://cgit.kde.org/kmail.git/commit/?id=2a348eccd352260f192d9b449492071bbf2b34b1 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-9604
https://notcve.org/view.php?id=CVE-2017-9604
13 Jun 2017 — KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network. KDE kmail anterior a la 5.5.2 y messagelib anterior a la 5.5.2, como distribuciones en aplicaciones KDE anteriores a la 17.04.2, no asegura que la acción de firma del plugin ocurre durante el uso de la característica Send Later... • https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7968
https://notcve.org/view.php?id=CVE-2016-7968
23 Dec 2016 — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed. KMail desde la versión 5.3.0 tal como se utiliza en un visor basado en QWebEngine que tenía habilitado JavaScript. Los contenidos de HTML Mail no fueron desinfectados para JavaScript y el código incluido fue ejecutado. • http://www.openwall.com/lists/oss-security/2016/10/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7967
https://notcve.org/view.php?id=CVE-2016-7967
23 Dec 2016 — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled. KMail desde la versión 5.3.0 como se utiliza en un visor basado en QWebEngine que tenía habilitado JavaScript. Dado que el html generado es ejecutado en el contexto de seguridad de archivos local mediante el acceso predeterminado a URLs remotas y locales estaba habilitado. • http://www.openwall.com/lists/oss-security/2016/10/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-7966 – Ubuntu Security Notice USN-3100-1
https://notcve.org/view.php?id=CVE-2016-7966
12 Oct 2016 — Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content. A través de una URL maliciosa que contenía un caracter de comillas era posible inyectar código HTML en el visor de texto plano de KMail. ... • http://lists.opensuse.org/opensuse-updates/2016-10/msg00065.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-7062
https://notcve.org/view.php?id=CVE-2006-7062
24 Feb 2007 — calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message. calendar.php en Kamgaing Email System (kmail) 2.3 y anteriores permiten a atacantes remotos obtener la ruta completa del servidor a través de un parámetro d inválido, lo cual filtra la ruta en un mensaje de error. • http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html •
CVSS: 6.8EPSS: 5%CPEs: 2EXPL: 1CVE-2006-2104
https://notcve.org/view.php?id=CVE-2006-2104
29 Apr 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter to main.php, ordner parameter to (2) main.php, or (3) webdisk.php, (4) draft parameter to compose.php, or (5) m, or (6) y parameter to calendar.php. • http://pridels0.blogspot.com/2006/04/kmail-23-vuln.html •
CVSS: 5.3EPSS: 3%CPEs: 2EXPL: 3CVE-2005-0404 – KDE KMail 1.7.1 - HTML EMail Remote Email Content Spoofing
https://notcve.org/view.php?id=CVE-2005-0404
13 Apr 2005 — KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed or encrypted, via HTML formatted email. • https://www.exploit-db.com/exploits/25375 •