CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2004-0689
https://notcve.org/view.php?id=CVE-2004-0689
19 Aug 2004 — KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files. KDE 3.3.0 no maneja adecuadamente ciertos enlaces simbólicos que apuntan a localizaciones "gastadas", lo que podría permitir a usaurios locales crear o truncar ficheros arbitrarios. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2004-0721
https://notcve.org/view.php?id=CVE-2004-0721
23 Jul 2004 — Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. Konqueror 3.1.3, 3.2.2, y posiblemente otras versiones no previenen adecuadamente que un marco de un dominio inyecte contenido en un marco que pertenece a otro dominio, lo que facilita la suplantación de sitios web y otros ataques. Vulnerabilidad tam... • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864 •
CVSS: 6.5EPSS: 2%CPEs: 12EXPL: 2CVE-2004-0527 – KDE Konqueror 3.x - Embedded Image URI Obfuscation
https://notcve.org/view.php?id=CVE-2004-0527
08 Jun 2004 — KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack. KDE Konqueror 2.1.1 y 2.2.2 permiten a atacantes remotos suplantar URL legítimas en la barra de estado mediante etiquetas A HREF con valores "alt" modificados que apuntan al sitio legítimo, combinado con un mapa de imagen cuyo HR... • https://www.exploit-db.com/exploits/24136 •
CVSS: 9.8EPSS: 30%CPEs: 1EXPL: 0CVE-2004-0411
https://notcve.org/view.php?id=CVE-2004-0411
20 May 2004 — The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code. Los manejadores de URI en Konqueror de KDE 3.2.2 y anteriores no filtran adecuadamente caractéres "-" en el inicio de un nombre de máquina en URIs (1) telnet, (2) rlogin, (3) ssh,... • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.1EPSS: 0%CPEs: 11EXPL: 1CVE-2003-0592
https://notcve.org/view.php?id=CVE-2003-0592
16 Mar 2004 — Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Konqueror en KDE 3.1.3 y anteriores (kdelibs) permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicació... • http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html •
CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 0CVE-2003-0988
https://notcve.org/view.php?id=CVE-2003-0988
17 Feb 2004 — Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. Desbordamiento de búfer en el lector de información de ficheros VCF del paquete KDE Personal Information Manager (kdepim) en KDE 3.1.0 a 3.1.4 permite a atacantes ejecutar código arbitrario mediante un fichero VCF. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000810 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 3CVE-2003-1478 – KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service
https://notcve.org/view.php?id=CVE-2003-1478
31 Dec 2003 — Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm. • https://www.exploit-db.com/exploits/22560 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0CVE-2003-0692
https://notcve.org/view.php?id=CVE-2003-0692
18 Sep 2003 — KDM in KDE 3.1.3 and earlier uses a weak session cookie generation algorithm that does not provide 128 bits of entropy, which allows attackers to guess session cookies via brute force methods and gain access to the user session. KDM en KDE 3.1.3 y anteriores usa un algoritmo de generación de galletita (cookie) de sesión débil, que no tiene 128 bits de entropía, lo que permite a atacantes adivinar galletitas de sesión mediante métodos de fuerza bruta y ganar acceso a la sesión del usuario. • http://cert.uni-stuttgart.de/archive/suse/security/2002/12/msg00101.html •
CVSS: 10.0EPSS: 15%CPEs: 27EXPL: 0CVE-2003-0690
https://notcve.org/view.php?id=CVE-2003-0690
18 Sep 2003 — KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module. KDM en KDE 3.1.3 y anteriores no verifica si la llamada a la función pam_setcred tiene éxito, lo que podría permitir a atacantes ganar privilegios de root disparando condiciones de error en módulo PAM, como se demostró en ciertas configuraciones de... • http://cert.uni-stuttgart.de/archive/suse/security/2002/12/msg00101.html •
CVSS: 9.8EPSS: 0%CPEs: 33EXPL: 0CVE-2003-0459
https://notcve.org/view.php?id=CVE-2003-0459
01 Aug 2003 — KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites. KDE Konqueror de KDE 3.1.2 y anteriores no elimina los credenciales de autenticación de URLs de la forma "usuario:contraseña@máquina" en la cabecera HTTP-Referer, lo que podría permitir a sitios web remotos robar las credenciales de páginas que enlazan a esos siti... • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747 •