CVE-2021-38373

all versions

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requir

5.3MEDIUM

CVE-2020-15954

all versions

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in

6.5MEDIUM

CVE-2020-11880

< 19.12.3

An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a websi

6.5MEDIUM

CVE-2019-10732

all versions

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multip

4.3MEDIUM

CVE-2017-17689

all versions

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exf

5.9MEDIUM

CVE-2014-8878

all versions

KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain s

5.9MEDIUM

CVE-2017-9604

<= 5.5.1

KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin

7.5HIGH

CVE-2016-7968

<= 5.3.0

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for Ja

6.5MEDIUM

CVE-2016-7967

<= 5.3.0

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the

8.1HIGH

CVE-2016-7966

<= 4.4.0

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to t

7.3HIGH

CVE-2006-7139

all versions

Kmail 1.9.1 on KDE 3.5.2, with "Prefer HTML to Plain Text" enabled, allows remote attackers to cause a denial of service (crash) v

CVE-2007-1265

all versions

KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually dis

CVE-2006-7062

<= 2.3

calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an

CVE-2006-2104

<= 2.3

Multiple cross-site scripting (XSS) vulnerabilities in Kamgaing Email System (kmail) 2.3 and earlier allow remote attackers to inj

CVE-2005-0404

all versions

KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed o

CVE-2002-0342

all versions

Kmail 1.2 on KDE 2.1.1 allows remote attackers to cause a denial of service (crash) via an email message whose body is approximate

CVE-1999-0735

<= 1.1

KDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories.

CVE-2000-0481

all versions

Buffer overflow in KDE Kmail allows a remote attacker to cause a denial of service via an attachment with a long file name.