| Vulnerability Name: | CVE-2014-8600 (CCN-98814) | ||||||||||||||||||||||||||||
| Assigned: | 2014-11-19 | ||||||||||||||||||||||||||||
| Published: | 2014-11-19 | ||||||||||||||||||||||||||||
| Updated: | 2018-10-30 | ||||||||||||||||||||||||||||
| Summary: | Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message. | ||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
3.8 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2014-8600 Source: SUSE Type: UNKNOWN openSUSE-SU-2015:0573 Source: CCN Type: KDE GIT Repository kwebkitpart Source: CCN Type: Full Disclosure Mailing List, Wed, 19 Nov 2014 11:59:35 +0000 CVE-2014-8600 - Insufficient Input Validation By IO Slaves In KDE e.V. KDE Source: FULLDISC Type: Exploit 20141119 CVE-2014-8600 - Insufficient Input Validation By IO Slaves In KDE e.V. KDE Source: UBUNTU Type: Patch, Vendor Advisory USN-2414-1 Source: BID Type: UNKNOWN 71190 Source: CCN Type: BID-71190 Multiple KDE Products CVE-2014-8600 Multiple Security Bypass Vulnerabilities Source: CCN Type: Red Hat Bugzilla Bug 1164609 CVE-2014-8600 kwebkitpart, kde-runtime: Insufficient Input Validation By IO Slaves and Webkit Part Source: XF Type: UNKNOWN kwebkitpart-cve20148600-code-exec(98814) Source: CCN Type: Packet Storm Security [11-19-2014] IO Slaves KDE Insufficient Input Validation Source: CCN Type: KDE Project Security Advisory Insufficient Input Validation By IO Slaves and Webkit Part Source: MISC Type: Exploit https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600/ Source: CCN Type: WhiteSource Vulnerability Database CVE-2014-8600 | ||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||