Lucene search

K
KdeKmail

11 matches found

CVE
CVE
added 2020/04/17 6:15 p.m.137 views

CVE-2020-11880

An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.b...

6.5CVSS6.3AI score0.00366EPSS
CVE
CVE
added 2019/04/07 3:29 p.m.135 views

CVE-2019-10732

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the in...

4.3CVSS4.2AI score0.0019EPSS
CVE
CVE
added 2018/05/16 7:29 p.m.96 views

CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

5.9CVSS5.6AI score0.00639EPSS
CVE
CVE
added 2016/12/23 10:59 p.m.68 views

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Al...

7.5CVSS7.2AI score0.00185EPSS
CVE
CVE
added 2024/10/28 12:15 a.m.58 views

CVE-2024-50624

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is re...

5.9CVSS6.8AI score0.00024EPSS
CVE
CVE
added 2021/08/10 3:15 p.m.56 views

CVE-2021-38373

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

5.3CVSS5.1AI score0.00268EPSS
CVE
CVE
added 2017/06/13 1:29 p.m.50 views

CVE-2017-9604

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.

7.5CVSS6.5AI score0.00263EPSS
CVE
CVE
added 2020/07/27 7:15 a.m.46 views

CVE-2020-15954

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

6.5CVSS6.2AI score0.00142EPSS
CVE
CVE
added 2017/09/28 1:29 a.m.43 views

CVE-2014-8878

KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network.

5.9CVSS5.5AI score0.00303EPSS
CVE
CVE
added 2016/12/23 10:59 p.m.38 views

CVE-2016-7967

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

8.1CVSS7.4AI score0.00332EPSS
CVE
CVE
added 2016/12/23 10:59 p.m.37 views

CVE-2016-7968

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.

7.5CVSS6.9AI score0.0024EPSS