CVSS: 5.0EPSS: 1%CPEs: 12EXPL: 2CVE-2004-0527 – KDE Konqueror 3.x - Embedded Image URI Obfuscation
https://notcve.org/view.php?id=CVE-2004-0527
KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack. KDE Konqueror 2.1.1 y 2.2.2 permiten a atacantes remotos suplantar URL legítimas en la barra de estado mediante etiquetas A HREF con valores "alt" modificados que apuntan al sitio legítimo, combinado con un mapa de imagen cuyo HREF apunta al sitio malicioso, lo que facilita ataques de suplantación para robo de datos (phising)". • https://www.exploit-db.com/exploits/24136 http://www.osvdb.org/6579 http://www.securityfocus.com/bid/10383 https://exchange.xforce.ibmcloud.com/vulnerabilities/16102 •
CVSS: 7.5EPSS: 17%CPEs: 1EXPL: 0CVE-2004-0411
https://notcve.org/view.php?id=CVE-2004-0411
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code. Los manejadores de URI en Konqueror de KDE 3.2.2 y anteriores no filtran adecuadamente caractéres "-" en el inicio de un nombre de máquina en URIs (1) telnet, (2) rlogin, (3) ssh, o (4) mailto, lo que permite a atacantes remotos manipular las opciones que son pasadas a los programas asociados, posiblemente permitiendo leer ficheros o ejecutar código de su elección. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843 http://marc.info/?l=bugtraq&m=108481412427344&w=2 http://secunia.com/advisories/11602 http://security.gentoo.org/glsa/glsa-200405-11.xml http://www.ciac.org/ciac/bulletins/o-146.shtml http://www.debian.org/security/2004/dsa-518 http://www.kde.org/info/security/advisory-20040517-1.txt http://www.novell.com/linux/security/advisories/2004_14_kdelibs.html http://www.osvdb.org/6107 http://www.red • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 1CVE-2003-0592
https://notcve.org/view.php?id=CVE-2003-0592
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application. Konqueror en KDE 3.1.3 y anteriores (kdelibs) permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicación web mediante secuencias de atravesamiento de directorios "%2e%2e" (punto punto codificado) en una URL, lo que hace que Konqueror envíe la cookie fuera de los subconjuntos de URL especificados, por ejemplo a una aplicación vulnerable que corre en el mismo servidor que la aplicación objetivo. • http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html http://www.debian.org/security/2004/dsa-459 http://www.mandriva.com/security/advisories?name=MDKSA-2004:022 http://www.redhat.com/support/errata/RHSA-2004-074.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823 https://access.redhat.com/security/cve/CVE-2003-0592 https://bugzilla.redhat.com/show_bug •
CVSS: 7.5EPSS: 3%CPEs: 4EXPL: 0CVE-2003-0988
https://notcve.org/view.php?id=CVE-2003-0988
Buffer overflow in the VCF file information reader for KDE Personal Information Management (kdepim) suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file. Desbordamiento de búfer en el lector de información de ficheros VCF del paquete KDE Personal Information Manager (kdepim) en KDE 3.1.0 a 3.1.4 permite a atacantes ejecutar código arbitrario mediante un fichero VCF. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000810 http://marc.info/?l=bugtraq&m=107412130407906&w=2 http://security.gentoo.org/glsa/glsa-200404-02.xml http://www.kb.cert.org/vuls/id/820798 http://www.kde.org/info/security/advisory-20040114-1.txt http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:003 http://www.redhat.com/support/errata/RHSA-2004-005.html http://www.redhat.com/support/errata/RHSA-2004-006.html http://www.securityfocus.c •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3CVE-2003-1478 – KDE Konqueror 3.0.3 - Malformed HTML Page Denial of Service
https://notcve.org/view.php?id=CVE-2003-1478
Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm. • https://www.exploit-db.com/exploits/22560 http://www.securityfocus.com/archive/1/320266 http://www.securityfocus.com/bid/7486 https://exchange.xforce.ibmcloud.com/vulnerabilities/11971 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •