CVE-2021-36370

CVE-2021-36370 affects Midnight Commander (mc) up to version 4.8.26, where the SFTP fingerprint of the server is neither checked nor displayed, preventing verification of server authenticity. Reported across multiple advisories (e.g., ALAS-2023-2147 for Amazon Linux 2 and openSUSE/SUSE advisories...

CVE-2012-4463

Affected software: GNU Midnight Commander (mc) 4.8.5 and similar releases. Vulnerability: improper handling/sanitization of environment variables MC_EXT_SELECTED and MC_EXT_ONLYTAGGED when multiple files are selected, enabling a user‑assisted remote attacker to execute arbitrary commands via a cr...