The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack (CAN-2002-0970) The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains. (CAN-2002-1151) Red Hat Advanced Server 2.1 provides KDE version 2.2.2 and is therefore vulnerable to both these issues.
It's fixed in kdelibs-2.2.2-3, which is still waiting for QA