CVE Feed

    Dashboard / CVE / CVE-2014-8878

    CVE-2014-8878

    KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers to obtain sensitive information by sniffing the network.

    Published:Oct 24, 2014
    Last Modified:Apr 20, 2025
    EPS:Sep 27, 2017
    EPSS Score:0.00303
    CVSS Score:5.9

    Affected Products

    Vendor
    Kde
    Product
    Kmail

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-50624 (CVSS 5.9) — ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-co…
    CVE-2021-38373 (CVSS 5.3) — In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) u…
    CVE-2020-15954 (CVSS 6.5) — KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates th…
    CVE-2020-11880 (CVSS 6.5) — An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=...…
    CVE-2019-10732 (CVSS 4.3) — In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts wit…
    CVE-2017-17689 (CVSS 5.9) — The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly l…
    CVE-2017-9604 (CVSS 7.5) — KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not …
    CVE-2016-7967 (CVSS 8.1) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html…
    CVE-2016-7968 (CVSS 6.5) — KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were …
    CVE-2016-7966 (CVSS 7.3) — Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaint…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High