Unscored severity · published Dec 8, 2014
CVE-2014-8600
Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KD
Kde-runtime · Kde
through 4.14.2 · source: NVD
KI
Kio-extras · Kde
through 5.1.1 · source: NVD
KW
Kwebkitpart · Urs Wolfer
through 1.3.3 · source: NVD
OP
Opensuse · Opensuse
13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8600
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html
Exploit
http://seclists.org/fulldisclosure/2014/Nov/54
Patch
http://ubuntu.com/usn/usn-2414-1
www.securityfocus.com
http://www.securityfocus.com/bid/71190
Exploit
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600/