{"id":"CVE-2014-8600","aliases":["EUVD-2014-8437","GHSA-6hhq-rgwv-cm5w","MGASA-2014-0478","UBUNTU-CVE-2014-8600","openSUSE-SU-2024:10497-1"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier,...","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02093,"percentile":0.81747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-11-20T00:00:00Z","modified":"2026-06-17T00:17:00Z","fixes":[{"ecosystem":"Mageia:3","package":"kdebase4-runtime","fixed_in":["4.10.5-1.2.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"kwebkitpart","fixed_in":["1.3.2-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kdebase4-runtime","fixed_in":["4.12.5-1.2.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kwebkitpart","fixed_in":["1.3.2-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"kde-runtime","fixed_in":["4:4.13.3-0ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"webkitkde","fixed_in":["1.3~git20120518.9a111005-3ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:3","package":"kdebase4-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.5-1.2.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"kwebkitpart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kdebase4-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.5-1.2.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kwebkitpart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"kde-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.13.3-0ubuntu0.2"}]}],"versions":["4:4.11.2-0ubuntu1","4:4.11.95-0ubuntu1","4:4.11.97-0ubuntu1","4:4.11.97-0ubuntu2","4:4.12.0-0ubuntu1","4:4.12.1-0ubuntu2","4:4.12.2-0ubuntu1","4:4.12.2-0ubuntu2","4:4.12.3-0ubuntu1","4:4.12.90-0ubuntu1","4:4.12.90-0ubuntu2","4:4.12.95-0ubuntu1","4:4.12.95-0ubuntu2","4:4.12.97-0ubuntu2","4:4.12.97-0ubuntu3","4:4.13.0-0ubuntu1","4:4.13.0-0ubuntu1.1","4:4.13.1-0ubuntu0.1","4:4.13.2-0ubuntu0.1","4:4.13.3-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"webkitkde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3~git20120518.9a111005-3ubuntu1"}]}],"versions":["1.3~git20120518.9a111005-3"]}],"products":[{"vendor":"kde","product":"kde-runtime"},{"vendor":"kde","product":"kio-extras"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"urs_wolfer","product":"kwebkitpart"}],"references":[{"url":"http://ubuntu.com/usn/usn-2414-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2014/Nov/54","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit"]},{"url":"http://www.securityfocus.com/bid/71190","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8600"},{"url":"https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600"},{"url":"https://github.com/advisories/GHSA-6hhq-rgwv-cm5w"},{"url":"https://advisories.mageia.org/MGASA-2014-0478.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14582","tags":["report"]},{"url":"https://www.kde.org/info/security/advisory-20141113-1.txt","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1164293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8600","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2414-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8600","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8600","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8600","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T13:26:00.973Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-8437","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T13:26:00Z","updated_at":"2026-11-03T01:56:51.537817Z"}],"ghsa":[{"id":"GHSA-6hhq-rgwv-cm5w","title":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier,...","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","status":"published","published":"2022-05-14T02:09:44Z","modified":"2025-04-12T12:42:38Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:19.407948Z"}],"nvd":[{"id":"CVE-2014-8600","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","status":"published","published":"2014-12-08T11:59:09.233Z","modified":"2026-06-17T00:17:00.173Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"MGASA-2014-0478","title":"Updated kdebase4-runtime and kwebkitpart packages fix security vulnerability","description":"kwebkitpart and the bookmarks:// io slave were not sanitizing input correctly\nallowing to some javascript being executed on the context of the referenced\nhostname (CVE-2014-8600).\n","status":"published","published":"2014-11-21T12:44:16Z","modified":"2026-04-16T06:23:06.599374476Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10497-1","title":"kio-extras5-16.12.0-1.1 on GA media","description":"These are all security issues fixed in the kio-extras5-16.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:56:20.048814Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2014-8600","description":"Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.","status":"published","published":"2014-11-20T00:00:00Z","modified":"2026-02-04T04:28:17.321579Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}