CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36041
https://notcve.org/view.php?id=CVE-2024-36041
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory. KSmserver en KDE Plasma Workspace (también conocido como plasma-workspace) anterior a 5.27.11.1 y 6.x anterior a 6.0.5.1 permite conexiones a través de ICE basadas exclusivamente en el host, es decir, se aceptan todas las conexiones locales. Esto permite que otro usuario en la misma máquina obtenga acceso al administrador de sesión, por ejemplo, use la función de restauración de sesión para ejecutar código arbitrario como víctima (en el siguiente inicio) mediante el uso anterior del directorio /tmp. • https://github.com/KDE/plasma-workspace/tags https://invent.kde.org/plasma/plasma-workspace https://kde.org/info/security/advisory-20240531-1.txt https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html • CWE-613: Insufficient Session Expiration •
CVSS: 3.1EPSS: 0%CPEs: 94EXPL: 0CVE-2024-1433 – KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
https://notcve.org/view.php?id=CVE-2024-1433
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. • https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01 https://vuldb.com/?ctiid.253407 https://vuldb.com/?id.253407 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6790 – kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element
https://notcve.org/view.php?id=CVE-2018-6790
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element. Se ha descubierto un problema en KDE Plasma Workspace en versiones anteriores a la 5.12.0 en el que dataengines/notifications/notificationsengine.cpp permite que los atacantes remotos descubran las direcciones IP de los clientes mediante una URL en una notificación, tal y como queda demostrado con el atributo src de un elemento IMG. • https://access.redhat.com/errata/RHSA-2019:2141 https://cgit.kde.org/plasma-workspace.git/commit/?id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c https://cgit.kde.org/plasma-workspace.git/commit/?id=8164beac15ea34ec0d1564f0557fe3e742bdd938 https://phabricator.kde.org/D10188 https://www.kde.org/announcements/plasma-5.11.5-5.12.0-changelog.php https://access.redhat.com/security/cve/CVE-2018-6790 https://bugzilla.redhat.com/show_bug.cgi?id=1543454 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6791
https://notcve.org/view.php?id=CVE-2018-6791
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder. Se ha descubierto un problema en soliduiserver/deviceserviceaction.cpp en KDE Plasma Workspace en versiones anteriores a la 5.12.0. Cuando una memoria USB vfat que contiene `` o $() en la etiqueta de la partición se enchufa o monta a través del notificador del dispositivo, se interpreta como un comando shell, lo que permite que se ejecuten comandos arbitrarios. • https://bugs.kde.org/show_bug.cgi?id=389815 https://cgit.kde.org/plasma-workspace.git/commit/?id=9db872df82c258315c6ebad800af59e81ffb9212 https://www.debian.org/security/2018/dsa-4116 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2312
https://notcve.org/view.php?id=CVE-2016-2312
Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Desactivar todas las pantallas en Plasma-workspace y kscreenlocker mientras se muestra la pantalla de bloqueo puede resultar en el desbloqueo de la pantalla cuando se vuelva a encender una pantalla. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177557.html https://bugs.kde.org/show_bug.cgi?id=358125 https://bugzilla.opensuse.org/show_bug.cgi?id=964548 https://www.kde.org/info/security/advisory-20160209-1.txt • CWE-254: 7PK - Security Features •