119 results · Feed
-
Unscored —
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. Th…
-
Unscored —
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed …
-
Low 3.7
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but…
-
Unscored —CVE-2021-41617 Public exploit
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalati…
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Unscored —
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstr…
-
High 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick chara…
-
Medium 5.9
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorith…
-
Unscored —
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, wh…
-
Unscored —
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integ…
-
Medium 6.8
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-…
-
Medium 6.8
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Medium 5.3
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filena…
-
Medium 5.3
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existen…
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…
-
Critical 9.8CVE-2016-1908 EPSS 14%
The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the loc…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
High 7.8
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensur…
-
Medium 6.2
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which mi…
-
High 7.3
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execut…
-
High 7.0CVE-2016-10010 Public exploit
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which…
-
High 7.5
The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of…
-
Unscored —
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password …
-
High 7.8
The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM i…
-
Medium 6.4
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users t…
-
Unscored —CVE-2016-1907 EPSS 14%
The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of ser…
-
Medium 6.5
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote ser…
-
High 8.1CVE-2016-0778 EPSS 21%
The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x bef…
-
Medium 6.4
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITO…
-
High 7.0
Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-O…
-
High 8.1CVE-2015-5600 Public exploit
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processi…
-
Unscored —
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks…
-
Medium 6.5
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger …
-
Medium 4.2
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote a…
-
Unscored —
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, doe…
-
High 7.5CVE-2010-5107 EPSS 17%
The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and …
-
Unscored —
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is en…