31 results · Clear filters · Feed
-
Medium 6.5
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during deco…
-
Medium 4.2
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended loc…
-
Medium 4.8
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding opera…
-
Medium 6.5
sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
-
Medium 5.9
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did no…
-
Medium 4.8
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if t…
-
Medium 4.2
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important…
-
Medium 4.2
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs betwe…
-
Medium 4.2
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is …
-
Medium 5.0
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X …
-
Medium 4.3
Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the clie…
-
Medium 4.2CVE-2026-35414 Public exploit
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list …
-
Medium 4.3
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it di…
-
Medium 5.9
Openssh: denial-of-service in openssh
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may k…
-
Medium 6.8CVE-2025-26465 Public exploit
Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific cond…
-
Medium 5.9
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…
-
Medium 5.5
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination const…
-
Medium 6.5
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…
-
Medium 5.3CVE-2016-20012 Public exploit
OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key…
-
Medium 6.8
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-…
-
Medium 6.8
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (…
-
Medium 5.9
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses w…
-
Medium 5.3
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filena…
-
Medium 5.3
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existen…
-
Medium 5.9
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
Medium 6.2
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which mi…
-
Medium 6.4
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users t…
-
Medium 6.5
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote ser…
-
Medium 6.4
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITO…