CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1308
https://notcve.org/view.php?id=CVE-2015-1308
kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked. kde-workspace 4.2.0 y plasma-workspace anterior a 5.1.95 permiten a atacantes remotos obtener eventos de entradas, y como consecuencia obtener contraseñas, mediante el aprovechamiento del acceso al servidor X cuando la pantalla está bloqueada. • http://secunia.com/advisories/62051 http://www.openwall.com/lists/oss-security/2015/01/22/6 http://www.securityfocus.com/bid/72284 https://www.kde.org/info/security/advisory-20150122-2.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2013-7252
https://notcve.org/view.php?id=CVE-2013-7252
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack. kwalletd en KWallet anterior a las aplicaciones KDE 14.12.0 utiliza Blowfish con el modo ECB en lugar del modo CBC cuando codifica el almacén de contraseñas, lo que facilita a atacantes adivinar las contraseñas a través de un ataque de libro de códigos (codebook). • http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis http://www.openwall.com/lists/oss-security/2014/01/02/3 http://www.openwall.com/lists/oss-security/2015/01/09/7 http://www.securityfocus.com/bid/67716 https://bugzilla.redhat.com/show_bug.cgi?id=1048168 https://security.gentoo.org/glsa/201606-19 https://www.kde.org/info/security/advisory-20150109-1.txt • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 2CVE-2014-8600 – IO Slaves KDE Insufficient Input Validation
https://notcve.org/view.php?id=CVE-2014-8600
Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message. Múltiples vulnerabilidades de XSS en KDE-Runtime 4.14.3 y anteriores, kwebkitpart 1.3.4 y anteriores, y kio-extras 5.1.1 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URI maniplada que utiliza la esquema (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar, lo que no se maneja correctamente en un mensaje de error. It was discovered that a number of the protocol handlers (referred to as IO slaves) did not satisfactorily handle malicious input. It is possible for an attacker to inject JavaScript by manipulating IO slave URI such that the JavaScript from the manipulated request is returned in the response. • http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html http://seclists.org/fulldisclosure/2014/Nov/54 http://ubuntu.com/usn/usn-2414-1 http://www.securityfocus.com/bid/71190 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2014-8651
https://notcve.org/view.php?id=CVE-2014-8651
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument. KDE Clock KCM Policykit Helper en kde-workspace anterior a 4.11.14 y plasma-desktop anterior a 5.1.1 permite a usuarios locales ganar privilegios a través de un argumento ntpUtility (ntp utility name) manipulado. • http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143781.html http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144034.html http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144093.html http://www.openwall.com/lists/oss-security/2014/11/04/9 http://www.openwall.com/lists/oss-security/2014/11/07/3 http://www.securityfocus.com/bid/70904 http://www.ubuntu.com/usn/USN-2402-1 https://security.gentoo.org/glsa/201512-12 htt • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.9EPSS: 0%CPEs: 38EXPL: 1CVE-2014-5033 – polkit-qt: insecure calling of polkit
https://notcve.org/view.php?id=CVE-2014-5033
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions." KDE kdelibs anterior a 4.14 y kauth anterior a 5.1 no utilizan debidamente D-Bus para la comunicación con una autoridad polkit, lo que permite a usuarios locales evadir las restricciones de acceso mediante el aprovechamiento de una condición de carrera PolkitUnixProcess PolkitSubject a través de un proceso (1) setuid o (2) pkexec, relacionado con el CVE-2013-4288 y 'condiciones de carrera de reuso PID.' It was found that polkit-qt handled authorization requests with PolicyKit via a D-Bus API that is vulnerable to a race condition. A local user could use this flaw to bypass intended PolicyKit authorizations. • http://lists.opensuse.org/opensuse-updates/2014-08/msg00012.html http://quickgit.kde.org/?p=kauth.git&a=commit&h=341b7d84b6d9c03cf56905cb277b47e11c81482a http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=e4e7b53b71e2659adaf52691d4accc3594203b23 http://rhn.redhat.com/errata/RHSA-2014-1359.html http://secunia.com/advisories/60385 http://secunia.com/advisories/60633 http://secunia.com/advisories/60654 http://www.debian.org/security/2014/dsa-3004 http://www.kde.org/info/security/advisory-201407 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •