CVE-2021-28117

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356Patch
https://github.com/KDE/discover/releasesThird Party Advisory
https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60Patch, Third Party Advisory
https://kde.org/info/security/advisory-20210310-1.txtPatch, Vendor Advisory
https://userbase.kde.org/DiscoverProduct, Vendor Advisory
https://github.com/KDE/discover/commit/fcd3b30552bf03a384b1a16f9bb8db029c111356Patch
https://github.com/KDE/discover/releasesThird Party Advisory
https://invent.kde.org/plasma/discover/commit/94478827aab63d2e2321f0ca9ec5553718798e60Patch, Third Party Advisory
https://kde.org/info/security/advisory-20210310-1.txtPatch, Vendor Advisory
https://userbase.kde.org/DiscoverProduct, Vendor Advisory

Timeline

Published: Mar 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281199.8Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC message to the expo CVE-2021-281219.8Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-281229.8A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to CVE-2021-281239.8Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281245.9A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6 CVE-2021-281256.1Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input fo CVE-2021-281266.1index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability CVE-2021-281277.5An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur.CVE-2021-281288.1In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who ga CVE-2021-281297.8While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid a CVE-2021-281307.8Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate b CVE-2021-281317.5Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the