CVE-2004-1158

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...

CVE-2004-1165

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command...

Konqueror fails to restrict access to Java classes

Overview The Konqueror web browser may allow Java applets and JavaScripts to bypass the Java security settings and access restricted Java classes. Exploitation may allow a remote attacker to read and write arbitrary files on a vulnerable system. Description Konqueror is a web browser and file...

CVE-2004-1145

Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier 1 allow access to restricted Java classes via JavaScript and 2 do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary file...

CVE-2004-1145

CVE-2004-1145 affects Konqueror/KDE up to version 3.3.1 where the Java sandbox could be bypassed by JavaScript or Java applets, allowing read/write of arbitrary files. The issue resides in the sandbox restrictions for Java in Konqueror and the FTP kioslave handling in KDE, enabling remote code ex...

KDE Security Advisory: Konqueror Java Vulnerability

KDE Security Advisory: Konqueror Java Vulnerability Original Release Date: 2004-12-20 URL: http://www.kde.org/info/security/advisory-20041220-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1145 http://www.heise.de/security/dienste/browsercheck/tests/java.shtml 1. Syste...

KDE Security Advisory: Konqueror Java Vulnerability

KDE Security Advisory: Konqueror Java Vulnerability Original Release Date: 2004-12-20 URL: http://www.kde.org/info/security/advisory-20041220-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1145 http://www.heise.de/security/dienste/browsercheck/tests/java.shtml 1. Syste...

CVE-2004-1145

Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier 1 allow access to restricted Java classes via JavaScript and 2 do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary file...

CVE-2004-1145

Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier 1 allow access to restricted Java classes via JavaScript and 2 do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary file...

Fedora Core 3 : kdebase-3.3.1-4.3.FC3 (2004-551)

Tue Dec 14 2004 Than Ngo 6:3.3.1-4.3.FC3 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Fri Dec 10 2004 Than Ngo 6:3.3.1-4.2.FC3 - Security Advisory: plain text password exposure, thanks to KDE security team - the existing...

Fedora Core 2 : kdelibs-3.2.2-10.FC2 (2004-548)

Tue Dec 14 2004 Than Ngo 6:3.2.2-10.FC2 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Security Advisory: plain text password exposure, 142487 thanks to KDE security team - Tue Sep 07 2004 Than Ngo 6:3.2.2-9.FC2 - add patch to...

Fedora Core 3 : kdelibs-3.3.1-2.4.FC3 (2004-550)

Tue Dec 14 2004 Than Ngo 3.3.1-2.4.FC3 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Fri Dec 10 2004 Than Ngo 3.3.1-2.3.FC3 - Security Advisory: plain text password exposure, 142487 thanks to KDE security team Note that...

Fedora Core 2 : kdebase-3.2.2-8.FC2 (2004-549)

Tue Dec 14 2004 Than Ngo 3.2.2-8.FC2 - apply the patch to fix Konqueror Window Injection Vulnerability 142510 CVE-2004-1158, Thanks to KDE security team - Security Advisory: plain text password exposure, 142487 thanks to KDE security team - Tue Sep 28 2004 Than Ngo 6:3.2.2-7.FC2 - fix kdm...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2004:150)

Daniel Fabian discovered a potential privacy issue in KDE. When creating a link to a remote file from various applications, including Konqueror, the resulting URL may contain the authentication credentials used to access that remote resource. This includes, but is not limited to, browsing SMB Sam...

CVE-2004-1165

Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline "%0a" before the FTP command, which causes the commands to be inserted into the resulting FTP session, as demonstrated using a PORT command...

CVE-2004-1158

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka t...

CVE-2004-1158

CVE-2004-1158 affects Konqueror 3.x up to 3.2.2-6 (and possibly other versions). The vulnerability, described as a window-injection issue, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab that resides in a different domain, demo...

CVE-2004-1165

CVE-2004-1165 affects Konqueror 3.3.1, where a crafted ftp:// URL containing a URL-encoded newline (%0a) can inject FTP commands (e.g., PORT) into the session. Exploitation would occur via remote interaction with the FTP handling code within Konqueror. Public advisories reference kdelibs/kdebase ...

kdelibs3 -- konqueror FTP command injection vulnerability

Albert Puigsech Galicia reports that Konqueror more specifically kioftp and Microsoft Internet Explorer are vulnerable to a FTP command injection vulnerability which can be exploited by tricking an user into clicking a specially crafted FTP URI. It is also reported by Ian Gulliver and Emanuele...

[Full-Disclosure] Password Disclosure for SMB Shares in KDE's Konqueror

------------------------------------------------------------------------- | Password Disclosure for SMB Shares in KDE's Konqueror | ------------------------------------------------------------------------- Date: Nov. 29, 2004 Author: Daniel Fabian Product: KDE, Konquerer Vendor: KDE e. V...