Threats tagged 'ghsa-ch75-3hqp-ffr6'

C-Kermit versions prior to 11.1.515 have an OS command injection vulnerability that allows remote clients to execute arbitrary shell commands. This occurs when unquoted arguments are supplied to the REMOTE WHO or REMOTE SPACE commands, enabling attackers to append shell metacharacters to arguments passed to syscmd(). This vulnerability can be exploited even if the DISABLE HOST setting is enabled.