Search criteria

12 vulnerabilities found for konqueror_embedded by kde

FKIE_CVE-2003-0592

Vulnerability from fkie_nvd - Published: 2004-04-15 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.htmlExploit, Vendor Advisory
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html
cve@mitre.orghttp://www.debian.org/security/2004/dsa-459Patch, Vendor Advisory
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2004:022
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2004-074.htmlPatch, Vendor Advisory
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.htmlExploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2004/dsa-459Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2004:022
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2004-074.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823
Impacted products
Vendor Product Version
kde konqueror 2.1.1
kde konqueror 2.2.2
kde konqueror 3.0
kde konqueror 3.0.1
kde konqueror 3.0.2
kde konqueror 3.0.3
kde konqueror 3.0.5
kde konqueror 3.1
kde konqueror 3.1.1
kde konqueror 3.1.2
kde konqueror_embedded 0.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kde:konqueror:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "417F34FB-A6B0-4090-BDC9-6D4C1BF0D3D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D435E39F-4F70-481B-9225-B072B79BEB69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AD68BAB-8945-4A22-938E-12C01D0111D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B3220BF-B0AF-4C90-89BD-B425EE58021D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA53FB7A-AF7F-45B2-AF23-11B1FC4EC289",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "619EB7F6-8694-4344-A4C9-A35DA58391AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FED2DFC-592C-4FD3-B0B7-C670C78F56DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F7BAE27-7AB1-4DBD-98AD-6109F0D9A458",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF8A54F6-96A9-44B8-97C8-50DA7276708D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1001754B-8EDB-41A2-9D5D-6E2A2B556DD0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror_embedded:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "68C3DE36-4687-4157-8C7F-223B289B9A8B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
    },
    {
      "lang": "es",
      "value": "Konqueror en KDE 3.1.3 y anteriores (kdelibs) permite a atacantes remotos saltarse las restriciones de cookies pretendidas en una aplicaci\u00f3n web mediante secuencias de atravesamiento de directorios \"%2e%2e\" (punto punto codificado) en una URL, lo que hace que Konqueror env\u00ede la cookie fuera de los subconjuntos de URL especificados, por ejemplo a una aplicaci\u00f3n vulnerable que corre en el mismo servidor que la aplicaci\u00f3n objetivo."
    }
  ],
  "id": "CVE-2003-0592",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": true,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-04-15T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2004/dsa-459"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2004/dsa-459"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2003-0459

Vulnerability from fkie_nvd - Published: 2003-08-27 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
References
cve@mitre.orghttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=105986238428061&w=2
cve@mitre.orghttp://www.debian.org/security/2003/dsa-361
cve@mitre.orghttp://www.kde.org/info/security/advisory-20030729-1.txt
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDKSA-2003:079
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2003-235.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2003-236.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.turbolinux.com/security/TLSA-2003-45.txt
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411
af854a3a-2127-422b-91ae-364da2661108http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000747
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=105986238428061&w=2
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2003/dsa-361
af854a3a-2127-422b-91ae-364da2661108http://www.kde.org/info/security/advisory-20030729-1.txt
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2003:079
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2003-235.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2003-236.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.turbolinux.com/security/TLSA-2003-45.txt
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411
Impacted products
Vendor Product Version
kde konqueror 2.1.1
kde konqueror 2.2.2
kde konqueror 3.0
kde konqueror 3.0.1
kde konqueror 3.0.2
kde konqueror 3.0.3
kde konqueror 3.0.5
kde konqueror 3.1
kde konqueror 3.1.1
kde konqueror 3.1.2
kde konqueror_embedded 0.1
redhat analog_real-time_synthesizer 2.1.1-5
redhat analog_real-time_synthesizer 2.2-11
redhat analog_real-time_synthesizer 2.2-11
redhat kdebase 3.0.3-13
redhat kdebase 3.0.3-13
redhat kdelibs 2.1.1-5
redhat kdelibs 2.2-11
redhat kdelibs 2.2-11
redhat kdelibs 3.0.0-10
redhat kdelibs 3.1-10
redhat kdelibs_devel 2.1.1-5
redhat kdelibs_devel 2.2-11
redhat kdelibs_devel 2.2-11
redhat kdelibs_devel 3.0.0-10
redhat kdelibs_devel 3.0.3-8
redhat kdelibs_devel 3.1-10
redhat kdelibs_sound 2.1.1-5
redhat kdelibs_sound 2.2-11
redhat kdelibs_sound 2.2-11
redhat kdelibs_sound_devel 2.1.1-5
redhat kdelibs_sound_devel 2.2-11
redhat kdelibs_sound_devel 2.2-11
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kde:konqueror:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "417F34FB-A6B0-4090-BDC9-6D4C1BF0D3D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D435E39F-4F70-481B-9225-B072B79BEB69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AD68BAB-8945-4A22-938E-12C01D0111D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7B3220BF-B0AF-4C90-89BD-B425EE58021D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA53FB7A-AF7F-45B2-AF23-11B1FC4EC289",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "619EB7F6-8694-4344-A4C9-A35DA58391AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FED2DFC-592C-4FD3-B0B7-C670C78F56DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F7BAE27-7AB1-4DBD-98AD-6109F0D9A458",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF8A54F6-96A9-44B8-97C8-50DA7276708D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror:3.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1001754B-8EDB-41A2-9D5D-6E2A2B556DD0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror_embedded:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "68C3DE36-4687-4157-8C7F-223B289B9A8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:analog_real-time_synthesizer:2.1.1-5:*:i386:*:*:*:*:*",
              "matchCriteriaId": "E69316C9-2654-43BB-BDC8-7E51817F2C39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:analog_real-time_synthesizer:2.2-11:*:i386:*:*:*:*:*",
              "matchCriteriaId": "41106F63-D866-4828-AF9B-E6CB74598BA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:analog_real-time_synthesizer:2.2-11:*:ia64:*:*:*:*:*",
              "matchCriteriaId": "F88FFE1F-B237-4576-A12F-C5EFDA06B3E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdebase:3.0.3-13:*:i386:*:*:*:*:*",
              "matchCriteriaId": "AA307F24-5698-4218-9119-AD9992E9224E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdebase:3.0.3-13:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "7A71CCC3-E8EE-4FB7-975C-EC7789253B71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs:2.1.1-5:*:i386:*:*:*:*:*",
              "matchCriteriaId": "6E963D5A-AC10-45CA-922C-2D42385C7B16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs:2.2-11:*:i386:*:*:*:*:*",
              "matchCriteriaId": "77CBE86A-D66F-47C9-9A2C-5DF8ACFF2B83",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs:2.2-11:*:ia64:*:*:*:*:*",
              "matchCriteriaId": "E064246D-9A5D-40AA-BA69-4B3100D2A899",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs:3.0.0-10:*:i386:*:*:*:*:*",
              "matchCriteriaId": "F6473F1B-EBCB-4631-B284-C6408AD09309",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs:3.1-10:*:i386:*:*:*:*:*",
              "matchCriteriaId": "BC791558-6B56-4774-8231-3CFEA3D827AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:2.1.1-5:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "186AB694-789E-45B4-B999-DB120341522E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:2.2-11:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "20F7B0DF-95B1-4DB2-A4C2-8F7B15CF733F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:2.2-11:*:ia64_dev:*:*:*:*:*",
              "matchCriteriaId": "CB838D21-B661-4E8F-B9CE-8800A12EC2BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:3.0.0-10:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "02819BAF-EA41-4E1A-8605-DB12B71C6DF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:3.0.3-8:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "3D1BDA11-0C20-42C2-9155-EC810B601962",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_devel:3.1-10:*:i386_dev:*:*:*:*:*",
              "matchCriteriaId": "63129CB5-8F86-42A1-811C-B912E4FA0864",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound:2.1.1-5:*:i386_sound:*:*:*:*:*",
              "matchCriteriaId": "17B843FA-0A1B-4FDF-8D61-DE622307AF6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound:2.2-11:*:i386_sound:*:*:*:*:*",
              "matchCriteriaId": "F590964D-DBC6-4455-9AC8-9DAF548E620A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound:2.2-11:*:ia64_sound:*:*:*:*:*",
              "matchCriteriaId": "DF8C9A0C-0031-41FF-9DCF-0E270841B53B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound_devel:2.1.1-5:*:i386_sound_dev:*:*:*:*:*",
              "matchCriteriaId": "471D4901-9512-43A3-AC2E-03A54197B981",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound_devel:2.2-11:*:i386_sound_dev:*:*:*:*:*",
              "matchCriteriaId": "7FB3EE08-A635-497B-A859-DDB1B2D86FF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:kdelibs_sound_devel:2.2-11:*:ia64_sound_dev:*:*:*:*:*",
              "matchCriteriaId": "99CC879D-A96B-4508-B146-4C57D2BB1CD6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the \"user:password@host\" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites."
    },
    {
      "lang": "es",
      "value": "KDE Konqueror de KDE 3.1.2 y anteriores no elimina los credenciales de autenticaci\u00f3n de URLs de la forma \"usuario:contrase\u00f1a@m\u00e1quina\" en la cabecera HTTP-Referer, lo que podr\u00eda permitir a sitios web remotos robar las credenciales de p\u00e1ginas que enlazan a esos sitios."
    }
  ],
  "id": "CVE-2003-0459",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-08-27T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2003/dsa-361"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2003/dsa-361"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2003-0370

Vulnerability from fkie_nvd - Published: 2003-06-16 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
References
cve@mitre.orghttp://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html
cve@mitre.orghttp://www.debian.org/security/2003/dsa-361
cve@mitre.orghttp://www.kde.org/info/security/advisory-20030602-1.txtPatch, Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2003-192.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2003-193.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/320707Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/7520
cve@mitre.orghttp://www.turbolinux.com/security/TLSA-2003-36.txt
af854a3a-2127-422b-91ae-364da2661108http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2003/dsa-361
af854a3a-2127-422b-91ae-364da2661108http://www.kde.org/info/security/advisory-20030602-1.txtPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2003-192.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2003-193.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/320707Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/7520
af854a3a-2127-422b-91ae-364da2661108http://www.turbolinux.com/security/TLSA-2003-36.txt
Impacted products
Vendor Product Version
apple safari 1.0
apple safari 1.0
kde konqueror_embedded 0.1
kde kde *
redhat linux 7.1
redhat linux 7.2
turbolinux turbolinux_server 7.0
turbolinux turbolinux_server 8.0
turbolinux turbolinux_workstation 7.0
turbolinux turbolinux_workstation 8.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "64FE1AA1-32D1-4825-8B2B-E66093937D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "E760CD65-A10E-44F1-B835-DA6B77057C93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror_embedded:0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "68C3DE36-4687-4157-8C7F-223B289B9A8B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:kde:kde:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EE0724E-B37D-4177-A117-74F5A39BCC5B",
              "versionEndIncluding": "2.2.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:linux:7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D46E093-1C68-43BB-B281-12117EC8DE0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:linux:7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E562907F-D915-4030-847A-3C6834A80D4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:turbolinux:turbolinux_server:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "839D2945-1417-43F5-A526-A14C491CBCEE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:turbolinux:turbolinux_server:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E06DCF0D-3241-453A-A0E4-937FE25EC404",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:turbolinux:turbolinux_workstation:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA8F79B3-2FBD-4CF1-B202-AB302C5F9CC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:turbolinux:turbolinux_workstation:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9428589A-0BD2-469E-978D-38239117D972",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack."
    },
    {
      "lang": "es",
      "value": "Konqueror Embedded y KDE 2.2.2  y anteriores no validan el campo Common Name (CN) en certificados X.509, lo que permitir\u00eda que atacantes remotos falsifiquen certificados mediante un ataque \"man-in-the-middle\"."
    }
  ],
  "id": "CVE-2003-0370",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-06-16T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2003/dsa-361"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/archive/1/320707"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/7520"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2003/dsa-361"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/archive/1/320707"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/7520"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2003-0355

Vulnerability from fkie_nvd - Published: 2003-06-09 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates.
References
cve@mitre.orghttp://www.securityfocus.com/archive/1/320707
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/320707
Impacted products
Vendor Product Version
apple safari 1.0
kde konqueror_embedded *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:safari:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A419AE8-F5A2-4E25-9004-AAAB325E201A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:kde:konqueror_embedded:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8D017B9-DF91-4E95-B47D-B0617D1343D6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates."
    },
    {
      "lang": "es",
      "value": "Safari 1.0 Beta 2 (v73) y anteriores no validan el campo Common Name (CN) para Certificados X.509, lo que permitir\u00eda a atacantes remotos falsificar certificados."
    }
  ],
  "id": "CVE-2003-0355",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-06-09T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/320707"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/320707"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2003-0592 (GCVE-0-2003-0592)

Vulnerability from cvelistv5 – Published: 2004-03-16 05:00 – Updated: 2024-08-08 01:58
VLAI?
Summary
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://lists.grok.org.uk/pipermail/full-disclosur… mailing-listx_refsource_FULLDISC
http://archives.neohapsis.com/archives/vulnwatch/… mailing-listx_refsource_VULNWATCH
http://www.debian.org/security/2004/dsa-459 vendor-advisoryx_refsource_DEBIAN
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://www.redhat.com/support/errata/RHSA-2004-074.html vendor-advisoryx_refsource_REDHAT
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRAKE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:58:11.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
          },
          {
            "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
            "tags": [
              "mailing-list",
              "x_refsource_VULNWATCH",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
          },
          {
            "name": "DSA-459",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2004/dsa-459"
          },
          {
            "name": "oval:org.mitre.oval:def:823",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
          },
          {
            "name": "RHSA-2004:074",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
          },
          {
            "name": "MDKSA-2004:022",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2004-03-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
        },
        {
          "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
          "tags": [
            "mailing-list",
            "x_refsource_VULNWATCH"
          ],
          "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
        },
        {
          "name": "DSA-459",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2004/dsa-459"
        },
        {
          "name": "oval:org.mitre.oval:def:823",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
        },
        {
          "name": "RHSA-2004:074",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
        },
        {
          "name": "MDKSA-2004:022",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0592",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
            },
            {
              "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
              "refsource": "VULNWATCH",
              "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
            },
            {
              "name": "DSA-459",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2004/dsa-459"
            },
            {
              "name": "oval:org.mitre.oval:def:823",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
            },
            {
              "name": "RHSA-2004:074",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
            },
            {
              "name": "MDKSA-2004:022",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0592",
    "datePublished": "2004-03-16T05:00:00",
    "dateReserved": "2003-07-18T00:00:00",
    "dateUpdated": "2024-08-08T01:58:11.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0459 (GCVE-0-2003-0459)

Vulnerability from cvelistv5 – Published: 2003-08-01 04:00 – Updated: 2024-08-08 01:58
VLAI?
Summary
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:58:09.652Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
          },
          {
            "name": "CLA-2003:747",
            "tags": [
              "vendor-advisory",
              "x_refsource_CONECTIVA",
              "x_transferred"
            ],
            "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
          },
          {
            "name": "DSA-361",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2003/dsa-361"
          },
          {
            "name": "oval:org.mitre.oval:def:411",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
          },
          {
            "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
          },
          {
            "name": "RHSA-2003:236",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
          },
          {
            "name": "RHSA-2003:235",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
          },
          {
            "name": "TLSA-2003-45",
            "tags": [
              "vendor-advisory",
              "x_refsource_TURBO",
              "x_transferred"
            ],
            "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
          },
          {
            "name": "MDKSA-2003:079",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-07-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the \"user:password@host\" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
        },
        {
          "name": "CLA-2003:747",
          "tags": [
            "vendor-advisory",
            "x_refsource_CONECTIVA"
          ],
          "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
        },
        {
          "name": "DSA-361",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2003/dsa-361"
        },
        {
          "name": "oval:org.mitre.oval:def:411",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
        },
        {
          "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
        },
        {
          "name": "RHSA-2003:236",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
        },
        {
          "name": "RHSA-2003:235",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
        },
        {
          "name": "TLSA-2003-45",
          "tags": [
            "vendor-advisory",
            "x_refsource_TURBO"
          ],
          "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
        },
        {
          "name": "MDKSA-2003:079",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0459",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the \"user:password@host\" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
            },
            {
              "name": "http://www.kde.org/info/security/advisory-20030729-1.txt",
              "refsource": "CONFIRM",
              "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
            },
            {
              "name": "CLA-2003:747",
              "refsource": "CONECTIVA",
              "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
            },
            {
              "name": "DSA-361",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2003/dsa-361"
            },
            {
              "name": "oval:org.mitre.oval:def:411",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
            },
            {
              "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
            },
            {
              "name": "RHSA-2003:236",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
            },
            {
              "name": "RHSA-2003:235",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
            },
            {
              "name": "TLSA-2003-45",
              "refsource": "TURBO",
              "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
            },
            {
              "name": "MDKSA-2003:079",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0459",
    "datePublished": "2003-08-01T04:00:00",
    "dateReserved": "2003-06-26T00:00:00",
    "dateUpdated": "2024-08-08T01:58:09.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0370 (GCVE-0-2003-0370)

Vulnerability from cvelistv5 – Published: 2003-06-05 04:00 – Updated: 2024-08-08 01:50
VLAI?
Summary
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:50:47.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2003:192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
          },
          {
            "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
          },
          {
            "name": "TLSA-2003-36",
            "tags": [
              "vendor-advisory",
              "x_refsource_TURBO",
              "x_transferred"
            ],
            "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
          },
          {
            "name": "RHSA-2003:193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
          },
          {
            "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320707"
          },
          {
            "name": "DSA-361",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2003/dsa-361"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
          },
          {
            "name": "7520",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/7520"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2003-06-06T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2003:192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
        },
        {
          "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
        },
        {
          "name": "TLSA-2003-36",
          "tags": [
            "vendor-advisory",
            "x_refsource_TURBO"
          ],
          "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
        },
        {
          "name": "RHSA-2003:193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
        },
        {
          "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/320707"
        },
        {
          "name": "DSA-361",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2003/dsa-361"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
        },
        {
          "name": "7520",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/7520"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0370",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2003:192",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
            },
            {
              "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
            },
            {
              "name": "TLSA-2003-36",
              "refsource": "TURBO",
              "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
            },
            {
              "name": "RHSA-2003:193",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
            },
            {
              "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/320707"
            },
            {
              "name": "DSA-361",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2003/dsa-361"
            },
            {
              "name": "http://www.kde.org/info/security/advisory-20030602-1.txt",
              "refsource": "CONFIRM",
              "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
            },
            {
              "name": "7520",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/7520"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0370",
    "datePublished": "2003-06-05T04:00:00",
    "dateReserved": "2003-06-03T00:00:00",
    "dateUpdated": "2024-08-08T01:50:47.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0355 (GCVE-0-2003-0355)

Vulnerability from cvelistv5 – Published: 2003-05-30 04:00 – Updated: 2024-09-17 03:43
VLAI?
Summary
Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/archive/1/320707 mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:50:47.682Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320707"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2003-05-30T04:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/320707"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0355",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/320707"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0355",
    "datePublished": "2003-05-30T04:00:00Z",
    "dateReserved": "2003-05-29T00:00:00Z",
    "dateUpdated": "2024-09-17T03:43:38.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0592 (GCVE-0-2003-0592)

Vulnerability from nvd – Published: 2004-03-16 05:00 – Updated: 2024-08-08 01:58
VLAI?
Summary
Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://lists.grok.org.uk/pipermail/full-disclosur… mailing-listx_refsource_FULLDISC
http://archives.neohapsis.com/archives/vulnwatch/… mailing-listx_refsource_VULNWATCH
http://www.debian.org/security/2004/dsa-459 vendor-advisoryx_refsource_DEBIAN
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://www.redhat.com/support/errata/RHSA-2004-074.html vendor-advisoryx_refsource_REDHAT
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRAKE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:58:11.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
          },
          {
            "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
            "tags": [
              "mailing-list",
              "x_refsource_VULNWATCH",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
          },
          {
            "name": "DSA-459",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2004/dsa-459"
          },
          {
            "name": "oval:org.mitre.oval:def:823",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
          },
          {
            "name": "RHSA-2004:074",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
          },
          {
            "name": "MDKSA-2004:022",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2004-03-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
        },
        {
          "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
          "tags": [
            "mailing-list",
            "x_refsource_VULNWATCH"
          ],
          "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
        },
        {
          "name": "DSA-459",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2004/dsa-459"
        },
        {
          "name": "oval:org.mitre.oval:def:823",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
        },
        {
          "name": "RHSA-2004:074",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
        },
        {
          "name": "MDKSA-2004:022",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0592",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrictions on a web application via \"%2e%2e\" (encoded dot dot) directory traversal sequences in a URL, which causes Konqueror to send the cookie outside the specified URL subsets, e.g. to a vulnerable application that runs on the same server as the target application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html"
            },
            {
              "name": "20040310 Corsaire Security Advisory: Multiple vendor HTTP user agent cookie path traversal issue",
              "refsource": "VULNWATCH",
              "url": "http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html"
            },
            {
              "name": "DSA-459",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2004/dsa-459"
            },
            {
              "name": "oval:org.mitre.oval:def:823",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A823"
            },
            {
              "name": "RHSA-2004:074",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2004-074.html"
            },
            {
              "name": "MDKSA-2004:022",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:022"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0592",
    "datePublished": "2004-03-16T05:00:00",
    "dateReserved": "2003-07-18T00:00:00",
    "dateUpdated": "2024-08-08T01:58:11.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0459 (GCVE-0-2003-0459)

Vulnerability from nvd – Published: 2003-08-01 04:00 – Updated: 2024-08-08 01:58
VLAI?
Summary
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:58:09.652Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
          },
          {
            "name": "CLA-2003:747",
            "tags": [
              "vendor-advisory",
              "x_refsource_CONECTIVA",
              "x_transferred"
            ],
            "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
          },
          {
            "name": "DSA-361",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2003/dsa-361"
          },
          {
            "name": "oval:org.mitre.oval:def:411",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
          },
          {
            "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
          },
          {
            "name": "RHSA-2003:236",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
          },
          {
            "name": "RHSA-2003:235",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
          },
          {
            "name": "TLSA-2003-45",
            "tags": [
              "vendor-advisory",
              "x_refsource_TURBO",
              "x_transferred"
            ],
            "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
          },
          {
            "name": "MDKSA-2003:079",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-07-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the \"user:password@host\" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
        },
        {
          "name": "CLA-2003:747",
          "tags": [
            "vendor-advisory",
            "x_refsource_CONECTIVA"
          ],
          "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
        },
        {
          "name": "DSA-361",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2003/dsa-361"
        },
        {
          "name": "oval:org.mitre.oval:def:411",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
        },
        {
          "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
        },
        {
          "name": "RHSA-2003:236",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
        },
        {
          "name": "RHSA-2003:235",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
        },
        {
          "name": "TLSA-2003-45",
          "tags": [
            "vendor-advisory",
            "x_refsource_TURBO"
          ],
          "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
        },
        {
          "name": "MDKSA-2003:079",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0459",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the \"user:password@host\" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20030729 KDE Security Advisory: Konqueror Referrer Authentication Leak",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-July/007300.html"
            },
            {
              "name": "http://www.kde.org/info/security/advisory-20030729-1.txt",
              "refsource": "CONFIRM",
              "url": "http://www.kde.org/info/security/advisory-20030729-1.txt"
            },
            {
              "name": "CLA-2003:747",
              "refsource": "CONECTIVA",
              "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000747"
            },
            {
              "name": "DSA-361",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2003/dsa-361"
            },
            {
              "name": "oval:org.mitre.oval:def:411",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A411"
            },
            {
              "name": "20030802 [slackware-security]  KDE packages updated (SSA:2003-213-01)",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=105986238428061\u0026w=2"
            },
            {
              "name": "RHSA-2003:236",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-236.html"
            },
            {
              "name": "RHSA-2003:235",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-235.html"
            },
            {
              "name": "TLSA-2003-45",
              "refsource": "TURBO",
              "url": "http://www.turbolinux.com/security/TLSA-2003-45.txt"
            },
            {
              "name": "MDKSA-2003:079",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2003:079"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0459",
    "datePublished": "2003-08-01T04:00:00",
    "dateReserved": "2003-06-26T00:00:00",
    "dateUpdated": "2024-08-08T01:58:09.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0370 (GCVE-0-2003-0370)

Vulnerability from nvd – Published: 2003-06-05 04:00 – Updated: 2024-08-08 01:50
VLAI?
Summary
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:50:47.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2003:192",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
          },
          {
            "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
          },
          {
            "name": "TLSA-2003-36",
            "tags": [
              "vendor-advisory",
              "x_refsource_TURBO",
              "x_transferred"
            ],
            "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
          },
          {
            "name": "RHSA-2003:193",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
          },
          {
            "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320707"
          },
          {
            "name": "DSA-361",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2003/dsa-361"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
          },
          {
            "name": "7520",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/7520"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2003-05-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2003-06-06T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2003:192",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
        },
        {
          "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
        },
        {
          "name": "TLSA-2003-36",
          "tags": [
            "vendor-advisory",
            "x_refsource_TURBO"
          ],
          "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
        },
        {
          "name": "RHSA-2003:193",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
        },
        {
          "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/320707"
        },
        {
          "name": "DSA-361",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2003/dsa-361"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
        },
        {
          "name": "7520",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/7520"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0370",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2003:192",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-192.html"
            },
            {
              "name": "20030510 [forward]Apple Safari and Konqueror Embedded Common Name Verification Vulnerability",
              "refsource": "FULLDISC",
              "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/004983.html"
            },
            {
              "name": "TLSA-2003-36",
              "refsource": "TURBO",
              "url": "http://www.turbolinux.com/security/TLSA-2003-36.txt"
            },
            {
              "name": "RHSA-2003:193",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2003-193.html"
            },
            {
              "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/320707"
            },
            {
              "name": "DSA-361",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2003/dsa-361"
            },
            {
              "name": "http://www.kde.org/info/security/advisory-20030602-1.txt",
              "refsource": "CONFIRM",
              "url": "http://www.kde.org/info/security/advisory-20030602-1.txt"
            },
            {
              "name": "7520",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/7520"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0370",
    "datePublished": "2003-06-05T04:00:00",
    "dateReserved": "2003-06-03T00:00:00",
    "dateUpdated": "2024-08-08T01:50:47.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2003-0355 (GCVE-0-2003-0355)

Vulnerability from nvd – Published: 2003-05-30 04:00 – Updated: 2024-09-17 03:43
VLAI?
Summary
Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/archive/1/320707 mailing-listx_refsource_BUGTRAQ
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T01:50:47.682Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/320707"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2003-05-30T04:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/320707"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2003-0355",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Safari 1.0 Beta 2 (v73) and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20030507 Problem: Multiple Web Browsers do not do not validate CN on certificates.",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/320707"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2003-0355",
    "datePublished": "2003-05-30T04:00:00Z",
    "dateReserved": "2003-05-29T00:00:00Z",
    "dateUpdated": "2024-09-17T03:43:38.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}