Unscored severity · published Dec 31, 2005
CVE-2005-4684
Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its search list, which allows remote attackers to trick a user into accepting a cookie for a hostname formed via search-list expansion of the hostname entered by the user, or steal a cookie for an expanded hostname, as demonstrated by an attacker who operates an ap1.com Internet web site to steal cookies associated with an ap1.com.example.com intranet web site.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
Konqueror · Kde
0.1; 2.1.1; 2.1.2; 2.2.1; 2.2.2; 3.0; +17 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-4684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-4684
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0123.html
www.securityfocus.com
http://www.securityfocus.com/bid/15331
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25291
More from Konqueror
–
CVE-2009-2537
KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to…
–
CVE-2008-5712
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1) a long COLOR attribute in an HR element; or a long (a)…
–
CVE-2008-5698
HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (application crash) via an invalid document.load call that…
–
CVE-2008-4382
Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large…
–
CVE-2007-6591
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all…