CVSS: 9.8EPSS: 2%CPEs: 142EXPL: 0CVE-2010-2251 – lftp: multiple HTTP client download filename vulnerability [OCERT 2010-001]
https://notcve.org/view.php?id=CVE-2010-2251
06 Jul 2010 — The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory. El comando get1, como el usado por lftpget, en LFTP anterior v4.0.6 no valida adecuadamente el nombre de fic... • http://lftp.yar.ru/news.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2007-2348 – lftp mirror --script does not escape names and targets of symbolic links
https://notcve.org/view.php?id=CVE-2007-2348
27 Apr 2007 — mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files. La secuencia de comandos mirror en lftp anterior a 3.5.9 no cita adecaudamente el interprete de carácteres metacaracter, lo cual podría permitir atacantes con la i... • http://bugs.gentoo.org/show_bug.cgi?id=173524 •
CVSS: 9.8EPSS: 15%CPEs: 11EXPL: 1CVE-2003-0963 – lftp 2.6.9 - Remote Stack Overflow
https://notcve.org/view.php?id=CVE-2003-0963
17 Dec 2003 — Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands. Desbordamiento de búfer en try_netscape_proxy y try_squid_eplf en lftp 2.6.9 y anteriores permite a servidores HTTP remotos ejecutar código arbitrario mediante nombres de directorio largos que son procesados por los comandos ls o rels. • https://www.exploit-db.com/exploits/143 •