CVE-2004-0411

CVE-2004-0411 describes improper filtering of leading '-' characters in hostname fields within telnet, rlogin, ssh, and mailto URI handlers in KDE/KDelibs up to version prior to 3.2.2 (and earlier). The vulnerability allows remote attackers to influence the options passed to the invoked programs,...

PT-2004-1550 · Kde +1 · Konqueror +2

Name of the Vulnerable Software and Affected Versions: KDE versions 3.2.2 and earlier Description: The issue is related to the URI handlers in Konqueror, which do not properly filter "-" characters that begin a hostname in certain URIs, such as telnet, rlogin, ssh, or mailto. This allows remote...

KDE Konqueror 3.x - Embedded Image URI Obfuscation

KDE Konqueror 3.x - Embedded Image URI Obfuscation source: https://www.securityfocus.com/bid/10383/info It is reported that KDE Konqueror is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted...

KDE Konqueror 3.x - Embedded Image URI Obfuscation

source: https://www.securityfocus.com/bid/10383/info It is reported that KDE Konqueror is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag. This weakness could be employed to trick a...

CVE-2003-0592

Konqueror in KDE 3.1.3 and earlier kdelibs allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a...

CVE-2003-0592

CVE-2003-0592 affects KDE’s kdelibs (Konqueror) up to version 3.1.3. The flaw lets remote attackers bypass cookie-path restrictions by using encoded relative path components (e.g., /.. or %2e%2e) in a URL, causing cookies to be sent to a path outside the intended subset and potentially to another...

CVE-2003-0592

Konqueror in KDE 3.1.3 and earlier kdelibs allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" encoded dot dot directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a...

Important: Red Hat Security Advisory: : Updated kdelibs packages resolve cookie security issue

Updated kdelibs packages that fix a flaw in cookie path handling are now available. Konqueror is a file manager and Web browser for the K Desktop Environment KDE. Flaws have been found in the cookie path handling between a number of Web browsers and servers. The HTTP cookie standard allows a Web...

Important: Red Hat Security Advisory: kdelibs security update

Updated kdelibs packages that fix a flaw in cookie path handling are now available. Konqueror is a file manager and Web browser for the K Desktop Environment KDE. Flaws have been found in the cookie path handling between a number of Web browsers and servers. The HTTP cookie standard allows a Web...

CVE-2003-1478

Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service core dump via a web page that begins with a "xFFxFE" byte sequence and a large number of CRLF sequences, as demonstrated using freeze.htm...

CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites...

Moderate: Red Hat Security Advisory: : Updated KDE packages fix security issue

This erratum provides updated KDE packages that resolve a security issue in Konquerer. KDE is a graphical desktop environment for the X Window System. Konqueror is the file manager for the K Desktop Environment. George Staikos reported that Konqueror may inadvertently send authentication...

KDE packages updated

New KDE packages are available for Slackware 9.0. These address a security issue where Konqueror may leak authentication credentials. Here are the details from the Slackware 9.0 ChangeLog: Fri Aug 1 15:15:51 PDT 2003 patches/packages/kde/: Upgraded to KDE 3.1.3. Note that this update addresses a...

CVE-2003-0459

KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites...

CVE-2003-0459

CVE-2003-0459 affects KDE Konqueror up to version 3.1.2, where credentials in URLs of the form user:password@host in the HTTP-Referer header are not removed. This may allow remote websites to steal user credentials for pages that link to them. The issue is a Kotlin? (not applicable) credential le...

Moderate: Red Hat Security Advisory: kdelibs security update

This erratum provides updated KDE packages that resolve a security issue in Konquerer. KDE is a graphical desktop environment for the X Window System. Konqueror is the file manager for the K Desktop Environment. George Staikos reported that Konqueror may inadvertently send authentication...

KDE Security Advisory: Konqueror Referrer Authentication Leak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Konqueror Referer Leaking Website Authentication Credentials Original Release Date: 2003-07-29 URL: http://www.kde.org/info/security/advisory-20030729-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-04...

CVE-2003-0370

Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name CN field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack...

CVE-2003-0370

CVE-2003-0370 affects Konqueror Embedded and KDE 2.2.2 and earlier, where the Common Name (CN) in X.509 certificates is not validated, enabling possible MITM certificate spoofing in TLS/SSL traffic. Public disclosures reference CAN-2003-0370 and describe the remote exploitation potential through ...

CVE-2003-0370

Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name CN field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack...