CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2018-10916 – lftp: particular remote file names may lead to current working directory erased
https://notcve.org/view.php?id=CVE-2018-10916
01 Aug 2018 — It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. Se ha descubierto que lftp hasta e incluyendo la versión 4.8.3 no sanea adecuadamente los nombres de archivo remoto, lo que... • http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 2%CPEs: 142EXPL: 0CVE-2010-2251 – lftp: multiple HTTP client download filename vulnerability [OCERT 2010-001]
https://notcve.org/view.php?id=CVE-2010-2251
06 Jul 2010 — The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory. El comando get1, como el usado por lftpget, en LFTP anterior v4.0.6 no valida adecuadamente el nombre de fic... • http://lftp.yar.ru/news.html • CWE-20: Improper Input Validation •