CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2021-36370
https://notcve.org/view.php?id=CVE-2021-36370
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity. Se ha detectado un problema en Midnight Commander versiones hasta 4.8.26. Cuando se establece una conexión SFTP, la huella digital del servidor no se comprueba ni se muestra. • https://docs.ssh-mitm.at/CVE-2021-36370.html https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484 https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c https://mail.gnome.org/archives/mc-devel/2021-August/msg00008.html https://midnight-commander.org https://sourceforge.net/projects/mcwin32/files • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 1%CPEs: 47EXPL: 0CVE-2004-1175
https://notcve.org/view.php?id=CVE-2004-1175
fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters. • http://secunia.com/advisories/13863 http://securitytracker.com/id?1012903 http://www.debian.org/security/2005/dsa-639 http://www.redhat.com/support/errata/RHSA-2005-512.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18906 https://access.redhat.com/security/cve/CVE-2004-1175 https://bugzilla.redhat.com/show_bug.cgi?id=1617387 •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2004-1092
https://notcve.org/view.php?id=CVE-2004-1092
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory. • http://secunia.com/advisories/13863 http://www.debian.org/security/2005/dsa-639 http://www.gentoo.org/security/en/glsa/glsa-200502-24.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/18904 •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2004-1174
https://notcve.org/view.php?id=CVE-2004-1174
direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles." • http://secunia.com/advisories/13863 http://securitytracker.com/id?1012903 http://www.debian.org/security/2005/dsa-639 http://www.redhat.com/support/errata/RHSA-2005-512.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18909 https://access.redhat.com/security/cve/CVE-2004-1174 https://bugzilla.redhat.com/show_bug.cgi?id=1617386 •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2004-1009
https://notcve.org/view.php?id=CVE-2004-1009
Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors. Midnight Commander (mc) 4.5.55 y versiones anteriores, permiten a atacantes remotos causar la Denegación de Servicio (DoS) por bucle infinito mediante un ataque desconocido. • http://secunia.com/advisories/13863 http://www.debian.org/security/2005/dsa-639 http://www.redhat.com/support/errata/RHSA-2005-512.html https://exchange.xforce.ibmcloud.com/vulnerabilities/18903 https://access.redhat.com/security/cve/CVE-2004-1009 https://bugzilla.redhat.com/show_bug.cgi?id=1617347 •