CVE-2004-1158

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window or tab whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Jan 10, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-11607.5Netscape 7.x to 7.2, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window CVE-2004-11617.5rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended CVE-2004-11627.5The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users tCVE-2004-11635.0Cisco CNS Network Registrar Central Configuration Management (CCM) server 6.0 through 6.1.1.3 allows remote attackers to cause a denial of sCVE-2004-11645.0The lock manager in Cisco CNS Network Registrar 6.0 through 6.1.1.3 allows remote attackers to cause a denial of service (process crash) viaCVE-2004-11657.5Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded newline ("%0a") befoCVE-2004-11667.5CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute arbitrary FTP commaCVE-2004-11675.0mirrorselect before 0.89 creates temporary files in a world-writable location with predictable file names, which allows remote attackers to CVE-2004-116810.0Stack-based buffer overflow in the WebDav handler in MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to execute arbitrary code CVE-2004-11695.0MaxDB WebTools 7.5.00.18 and earlier allows remote attackers to cause a denial of service (application crash) via an HTTP GET request for a CVE-2004-117010.0a2ps 4.13 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename.CVE-2004-11712.1KDE 3.2.x and 3.3.0 through 3.3.2, when saving credentials that are (1) manually entered by the user or (2) created by the SMB protocol hand
CVE-2004-1158: High severity, CVSS 7.5 | Vulnix