Threats tagged 'ghsa-qxjp-vcjc-38gx'

C-Kermit versions prior to 11.1.515 contain a vulnerability that allows malicious Kermit servers to bypass the RECEIVE CONFIRM prompt. This flaw enables attackers to write files without user consent by exploiting recursive GET root computation, potentially placing files like .ssh/authorized_keys or shell startup scripts in the current directory. Such unauthorized file writes can lead to persistent access or code execution.