CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45198
https://notcve.org/view.php?id=CVE-2023-45198
ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable. ftpd antes de "NetBSD-ftpd 20230930" puede filtrar información sobre el sistema de archivos del host antes de la autenticación mediante un comando MLSD o MLST. tnftpd (la versión portátil de NetBSD ftpd) anterior a 20231001 también es vulnerable. • http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95 https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 1CVE-2013-2512
https://notcve.org/view.php?id=CVE-2013-2512
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic. La gema ftpd versión 0.2.1 para Ruby, permite a atacantes remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres de shell en un argumento de comando LIST o NLST dentro del tráfico del protocolo FTP • http://vapidlabs.com/advisory.php?v=34 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2002-2245
https://notcve.org/view.php?id=CVE-2002-2245
ftpd in NetBSD 1.5 through 1.5.3 and 1.6 does not properly quote a digit in response to a STAT command for a filename that contains a carriage return followed by a digit, which can cause firewalls and other intermediary devices to lose proper track of the FTP session. • ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2002-027.txt.asc • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 4%CPEs: 20EXPL: 1CVE-2000-0574 – OpenBSD - 'ftp' Local Overflow
https://notcve.org/view.php?id=CVE-2000-0574
FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands. • https://www.exploit-db.com/exploits/396 ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-009.txt.asc http://archives.neohapsis.com/archives/bugtraq/2000-07/0031.html http://archives.neohapsis.com/archives/bugtraq/2000-07/0061.html http://archives.neohapsis.com/archives/bugtraq/2000-07/0121.html http://www.cert.org/advisories/CA-2000-13.html http://www.securityfocus.com/bid/1425 http://www.securityfocus.com/bid/1438 •