Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 381

Export CSV
CVE-2016-1908

openssh: possible fallback from untrusted to trusted X11 forwarding

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed
Vendors
Debian Openbsd Oracle and 1 more
Products
Debian Linux Openssh Linux and 7 more
CVE-2016-10012

openssh: Bounds check can be evaded in the shared memory manager used by pre-authentication compression support

The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10011

openssh: Leak of host private key material to privilege-separated child process via realloc()

authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

CVSS 3.1 · 6.2 Medium EPSS 1.1% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-10010

openssh: privilege escalation via Unix domain socket forwarding

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.

CVSS 3.1 · 7 High EPSS 4.2% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2016-10009

openssh: loading of untrusted PKCS#11 modules in ssh-agent

Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVSS 3.1 · 7.3 High EPSS 37.4% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2016-0778

OpenSSH: Client buffer-overflow when using roaming connections

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

CVSS 3.1 · 8.1 High EPSS 20.9% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Virtual Customer Access System Openssh and 4 more
CVE-2016-0777

OpenSSH: Client Information leak due to use of roaming connection feature

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

CVSS 3.1 · 6.5 Medium EPSS 63.5% KEV · Not listed
Vendors
Apple Hp Openbsd and 3 more
Products
Mac Os X Remote Device Access Virtual Customer Access System Openssh and 5 more
CVE-2011-4327

openssh: Unauthorized local access to host keys on platforms where ssh-rand-helper used

ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, which allows local users to obtain sensitive key information via the ptrace system call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2011-0539

OpenSSH: legacy certificate generation information leak

The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2010-5107

openssh: Prevent connection slot exhaustion attacks

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

CVSS 3.1 · 7.5 High EPSS 16.9% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2021-36368

openssh: possible bypass of fido 2 devices and ssh-askpass

An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

CVSS 3.1 · 3.7 Low EPSS 1.7% KEV · Not listed
Vendors
Debian Openbsd
Products
Debian Linux Openssh
CVE-2016-20012

openssh: Public key information leak

OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product

CVSS 3.1 · 5.3 Medium EPSS 5.3% KEV · Not listed
Vendors
Netapp Openbsd
Products
Clustered Data Ontap Hci Management Node Ontap Select Deploy Administration Utility and 2 more
CVE-2010-4478

openssh: J-PAKE authentication bypass

OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2017-15906

openssh: Improper write operations in readonly mode allow for zero-length file creation

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

CVSS 3.1 · 5.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Debian Netapp Openbsd and 2 more
Products
Debian Linux Active Iq Unified Manager Cloud Backup and 20 more
CVE-2008-5161

OpenSSH: Plaintext Recovery Attack against CBC ciphers

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.

CVSS 3.1 · 3.7 Low EPSS 18.6% KEV · Not listed
Vendors
Openbsd Redhat Ssh
Products
Openssh Enterprise Linux Tectia Client and 3 more
CVE-2014-2653

openssh: failure to check DNS SSHFP records in certain scenarios

The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2014-1692

openssh: uninitialized variable use in J-PAKE implementation

The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.

CVSS 3.1 · 7.3 High EPSS 4.7% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2015-6564

openssh: Use-after-free bug related to PAM support

Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux
CVE-2015-6563

openssh: Privilege separation weakness related to PAM support

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Openbsd Redhat
Products
Mac Os X Openssh Enterprise Linux