Kmail

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.

Published: 2024-10-27T00:00:00.000Z
Updated: 2025-05-31T08:03:29.146Z

An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.

Published: 2020-04-17T17:07:26.000Z
Updated: 2024-08-04T11:42:00.582Z

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.

Published: 2017-06-13T13:00:00.000Z
Updated: 2024-09-17T02:16:34.175Z

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.

Published: 2016-12-23T22:00:00.000Z
Updated: 2024-08-06T02:13:21.867Z

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.

Published: 2016-12-23T22:00:00.000Z
Updated: 2024-08-06T02:13:21.600Z