CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-36041
https://notcve.org/view.php?id=CVE-2024-36041
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory. KSmserver en KDE Plasma Workspace (también conocido como plasma-workspace) anterior a 5.27.11.1 y 6.x anterior a 6.0.5.1 permite conexiones a través de ICE basadas exclusivamente en el host, es decir, se aceptan todas las conexiones locales. Esto permite que otro usuario en la misma máquina obtenga acceso al administrador de sesión, por ejemplo, use la función de restauración de sesión para ejecutar código arbitrario como víctima (en el siguiente inicio) mediante el uso anterior del directorio /tmp. • https://github.com/KDE/plasma-workspace/tags https://invent.kde.org/plasma/plasma-workspace https://kde.org/info/security/advisory-20240531-1.txt https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html • CWE-613: Insufficient Session Expiration •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6790 – kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element
https://notcve.org/view.php?id=CVE-2018-6790
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element. Se ha descubierto un problema en KDE Plasma Workspace en versiones anteriores a la 5.12.0 en el que dataengines/notifications/notificationsengine.cpp permite que los atacantes remotos descubran las direcciones IP de los clientes mediante una URL en una notificación, tal y como queda demostrado con el atributo src de un elemento IMG. • https://access.redhat.com/errata/RHSA-2019:2141 https://cgit.kde.org/plasma-workspace.git/commit/?id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c https://cgit.kde.org/plasma-workspace.git/commit/?id=8164beac15ea34ec0d1564f0557fe3e742bdd938 https://phabricator.kde.org/D10188 https://www.kde.org/announcements/plasma-5.11.5-5.12.0-changelog.php https://access.redhat.com/security/cve/CVE-2018-6790 https://bugzilla.redhat.com/show_bug.cgi?id=1543454 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6791
https://notcve.org/view.php?id=CVE-2018-6791
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder. Se ha descubierto un problema en soliduiserver/deviceserviceaction.cpp en KDE Plasma Workspace en versiones anteriores a la 5.12.0. Cuando una memoria USB vfat que contiene `` o $() en la etiqueta de la partición se enchufa o monta a través del notificador del dispositivo, se interpreta como un comando shell, lo que permite que se ejecuten comandos arbitrarios. • https://bugs.kde.org/show_bug.cgi?id=389815 https://cgit.kde.org/plasma-workspace.git/commit/?id=9db872df82c258315c6ebad800af59e81ffb9212 https://www.debian.org/security/2018/dsa-4116 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2312
https://notcve.org/view.php?id=CVE-2016-2312
Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Desactivar todas las pantallas en Plasma-workspace y kscreenlocker mientras se muestra la pantalla de bloqueo puede resultar en el desbloqueo de la pantalla cuando se vuelva a encender una pantalla. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177557.html https://bugs.kde.org/show_bug.cgi?id=358125 https://bugzilla.opensuse.org/show_bug.cgi?id=964548 https://www.kde.org/info/security/advisory-20160209-1.txt • CWE-254: 7PK - Security Features •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1307
https://notcve.org/view.php?id=CVE-2015-1307
plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package. plasma-workspace anterior a 5.1.95 permite a atacantes remotos obtener contraseñas a través de un paquete 'Look and Feel' troyano. • http://www.openwall.com/lists/oss-security/2015/01/22/6 http://www.securityfocus.com/bid/72285 https://www.kde.org/info/security/advisory-20150122-1.txt • CWE-284: Improper Access Control •