CVE-2021-31855

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server (e.g., an IMAP server) causes KMail to upload the decrypted content of the message to the remote server. With a crafted message, a user could be tricked into decrypting an encrypted message and then deleting an attachment attached to this message. If the attacker has access to the messages stored on the email server, then the attacker could read the decrypted content of the encrypted message. This occurs in ViewerPrivate::deleteAttachment in messageviewer/src/viewer/viewer_p.cpp.

• CWE-312

• https://github.com/KDE/messagelib/commit/3b5b171e91ce78b966c98b1292a1bcbc8d984799
• https://kde.org/info/security/advisory-20210429-1.txtVendor Advisory
• https://github.com/KDE/messagelib/commit/3b5b171e91ce78b966c98b1292a1bcbc8d984799
• https://kde.org/info/security/advisory-20210429-1.txtVendor Advisory

Published

Jun 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3185A flaw was found in the gstreamer h264 component of gst-plug…9.8
• CVE-2021-31850A denial-of-service vulnerability in Database Security (DBS)…6.1
• CVE-2021-31851A Reflected Cross-Site Scripting vulnerability in McAfee Pol…6.1
• CVE-2021-31852A Reflected Cross-Site Scripting vulnerability in McAfee Pol…6.1
• CVE-2021-31853DLL Search Order Hijacking Vulnerability in McAfee Drive Enc…7.8
• CVE-2021-31854A command Injection Vulnerability in McAfee Agent (MA) for W…7.8
• CVE-2021-31856A SQL Injection vulnerability in the REST API in Layer5 Mesh…9.8
• CVE-2021-31857In Zoho ManageEngine Password Manager Pro before 11.1 build …5.9
• CVE-2021-31858DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-S…5.4
• CVE-2021-31859Incorrect privileges in the MU55 FlexiSpooler service in YSo…7.8
• CVE-2021-3186A Stored Cross-site scripting (XSS) vulnerability in /main.h…5.4
• CVE-2021-31862SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parame…6.1