CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2004-0721
https://notcve.org/view.php?id=CVE-2004-0721
Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. Konqueror 3.1.3, 3.2.2, y posiblemente otras versiones no previenen adecuadamente que un marco de un dominio inyecte contenido en un marco que pertenece a otro dominio, lo que facilita la suplantación de sitios web y otros ataques. Vulnerabilidad también conocida como "de inyección de marco". • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864 http://marc.info/?l=bugtraq&m=109225538901170&w=2 http://secunia.com/advisories/11978 http://secunia.com/multiple_browsers_frame_injection_vulnerability_test http://security.gentoo.org/glsa/glsa-200408-13.xml http://www.kde.org/info/security/advisory-20040811-3.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/1598 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11371 https://acc •
CVSS: 5.0EPSS: 1%CPEs: 12EXPL: 2CVE-2004-0527 – KDE Konqueror 3.x - Embedded Image URI Obfuscation
https://notcve.org/view.php?id=CVE-2004-0527
KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack. KDE Konqueror 2.1.1 y 2.2.2 permiten a atacantes remotos suplantar URL legítimas en la barra de estado mediante etiquetas A HREF con valores "alt" modificados que apuntan al sitio legítimo, combinado con un mapa de imagen cuyo HREF apunta al sitio malicioso, lo que facilita ataques de suplantación para robo de datos (phising)". • https://www.exploit-db.com/exploits/24136 http://www.osvdb.org/6579 http://www.securityfocus.com/bid/10383 https://exchange.xforce.ibmcloud.com/vulnerabilities/16102 •
CVSS: 7.5EPSS: 17%CPEs: 1EXPL: 0CVE-2004-0411
https://notcve.org/view.php?id=CVE-2004-0411
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code. Los manejadores de URI en Konqueror de KDE 3.2.2 y anteriores no filtran adecuadamente caractéres "-" en el inicio de un nombre de máquina en URIs (1) telnet, (2) rlogin, (3) ssh, o (4) mailto, lo que permite a atacantes remotos manipular las opciones que son pasadas a los programas asociados, posiblemente permitiendo leer ficheros o ejecutar código de su elección. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843 http://marc.info/?l=bugtraq&m=108481412427344&w=2 http://secunia.com/advisories/11602 http://security.gentoo.org/glsa/glsa-200405-11.xml http://www.ciac.org/ciac/bulletins/o-146.shtml http://www.debian.org/security/2004/dsa-518 http://www.kde.org/info/security/advisory-20040517-1.txt http://www.novell.com/linux/security/advisories/2004_14_kdelibs.html http://www.osvdb.org/6107 http://www.red • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 1CVE-2003-0592
https://notcve.org/view.php?id=CVE-2003-0592
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Konqueror en KDE 3.1.3 y anteriores (kdelibs) permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicación web mediante secuencias de atravesamiento de directorios "%2e%2e" (punto punto codificado) en una URL, lo que hace que Konqueror envíe la cookie fuera de los subconjuntos de URL especificados, por ejemplo a una aplicación vulnerable que corre en el mismo servidor que la aplicación objetivo. • http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html http://www.debian.org/security/2004/dsa-459 http://www.mandriva.com/security/advisories?name=MDKSA-2004:022 http://www.redhat.com/support/errata/RHSA-2004-074.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823 https://access.redhat.com/security/cve/CVE-2003-0592 https://bugzilla.redhat.com/show_bug •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2003-1478 – KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service
https://notcve.org/view.php?id=CVE-2003-1478
Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm. • https://www.exploit-db.com/exploits/22560 http://www.securityfocus.com/archive/1/320266 http://www.securityfocus.com/bid/7486 https://exchange.xforce.ibmcloud.com/vulnerabilities/11971 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •