Overview 275 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
275matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
8
2.9%
Not applicable
267
97.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
275
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
275
100.0%
split by
peak 32 / year
19973
Not applicable3
Medium2
Low1
not blocked3
No public exploit3
19987
Not applicable7
High5
Medium2
not blocked7
No public exploit7
199911
Not applicable11
Medium5
Low6
not blocked11
No public exploit11
200012
Not applicable12
High7
Medium5
not blocked12
No public exploit12
200122
Not applicable22
High12
Medium7
Low3
not blocked22
No public exploit22
200218
Not applicable18
Critical1
High6
Medium8
Low3
not blocked18
No public exploit18
200311
Not applicable11
High9
Medium2
not blocked11
No public exploit11
200427
Not applicable27
High12
Medium14
Low1
not blocked27
No public exploit27
20057
Not applicable7
Medium6
Low1
not blocked7
No public exploit7
200613
Not applicable13
High3
Medium10
not blocked13
No public exploit13
20077
Outside Waratek scope1
Not applicable6
High1
Medium5
Low1
not blocked7
No public exploit7
20088
Not applicable8
High4
Medium2
Low2
not blocked8
No public exploit8
20093
Not applicable3
Medium3
not blocked3
No public exploit3
20101
Not applicable1
Critical1
not blocked1
No public exploit1
20116
Not applicable6
High3
Medium3
not blocked6
No public exploit6
20122
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
20132
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20148
Outside Waratek scope1
Not applicable7
High2
Medium6
not blocked8
No public exploit8
20154
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20163
Not applicable3
High2
Medium1
not blocked3
No public exploit3
201718
Outside Waratek scope1
Not applicable17
Critical3
High4
Medium11
not blocked18
No public exploit18
20184
Outside Waratek scope1
Not applicable3
High2
Medium2
not blocked4
No public exploit4
20199
Outside Waratek scope1
Not applicable8
Critical2
High7
not blocked9
No public exploit9
20205
Outside Waratek scope1
Not applicable4
Critical2
High2
Medium1
not blocked5
No public exploit5
20218
Outside Waratek scope2
Not applicable6
High5
Medium3
not blocked8
No public exploit8
20223
Not applicable3
High2
Low1
not blocked3
No public exploit3
20239
Not applicable9
Critical3
High3
Medium3
not blocked9
No public exploit9
202410
Not applicable10
Critical2
High3
Medium4
Low1
not blocked10
No public exploit10
20252
Not applicable2
High1
Medium1
not blocked2
No public exploit2
202632
Not applicable32
Critical1
High9
Medium15
Low7
not blocked32
No public exploit32
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-106583 | High | 2026-10-07 | Not applicable | No public exploit | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
| CVE-2026-106587 | Low | 2026-10-06 | Not applicable | No public exploit | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. |
| CVE-2026-106586 | Medium | 2026-10-06 | Not applicable | No public exploit | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283. |
| CVE-2026-106585 | Medium | 2026-10-06 | Not applicable | No public exploit | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. |
| CVE-2026-106584 | Low | 2026-10-06 | Not applicable | No public exploit | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations. |
| CVE-2026-106582 | Low | 2026-10-06 | Not applicable | No public exploit | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. |
| CVE-2026-106555 | High | 2026-10-06 | Not applicable | No public exploit | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. |
| CVE-2026-106553 | High | 2026-10-06 | Not applicable | No public exploit | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. |
| CVE-2026-106552 | Medium | 2026-10-06 | Not applicable | No public exploit | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation. |
| CVE-2026-73283 | Low | 2026-08-11 | Not applicable | No public exploit | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
| CVE-2026-73282 | Medium | 2026-08-11 | Not applicable | No public exploit | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. |
| CVE-2026-73281 | Low | 2026-08-11 | Not applicable | No public exploit | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension. |
| CVE-2026-60002 | Critical | 2026-07-08 | Not applicable | No public exploit | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.) |
| CVE-2026-60001 | Medium | 2026-07-08 | Not applicable | No public exploit | sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. |
| CVE-2026-60000 | High | 2026-07-08 | Not applicable | No public exploit | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication. |
| CVE-2026-59999 | High | 2026-07-08 | Not applicable | No public exploit | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. |
| CVE-2026-59998 | Medium | 2026-07-08 | Not applicable | No public exploit | sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. |
| CVE-2026-59997 | Medium | 2026-07-08 | Not applicable | No public exploit | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection. |
| CVE-2026-59996 | Medium | 2026-07-08 | Not applicable | No public exploit | scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations. |
| CVE-2026-59995 | Medium | 2026-07-08 | Not applicable | No public exploit | sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server. |
| CVE-2026-57589 | High | 2026-06-25 | Not applicable | No public exploit | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget(). |
| CVE-2026-55655 | Medium | 2026-06-23 | Not applicable | No public exploit | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session. |
| CVE-2026-55654 | Low | 2026-06-23 | Not applicable | No public exploit | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service. |
| CVE-2026-55653 | Medium | 2026-06-23 | Not applicable | No public exploit | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS). |
| CVE-2026-56099 | Medium | 2026-06-18 | Not applicable | No public exploit | OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set. |
| CVE-2026-41285 | Medium | 2026-04-21 | Not applicable | No public exploit | In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero. |
| CVE-2026-35414 | High | 2026-04-02 | Not applicable | No public exploit | OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters. |
| CVE-2026-35388 | Low | 2026-04-02 | Not applicable | No public exploit | OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. |
| CVE-2026-35387 | Medium | 2026-04-02 | Not applicable | No public exploit | OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms. |
| CVE-2026-35386 | High | 2026-04-02 | Not applicable | No public exploit | In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config. |
| CVE-2026-35385 | High | 2026-04-02 | Not applicable | No public exploit | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode). |
| CVE-2026-3497 | Medium | 2026-03-12 | Not applicable | No public exploit | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration. |
| CVE-2025-32728 | Medium | 2025-04-10 | Not applicable | No public exploit | In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. |
| CVE-2025-30334 | High | 2025-03-20 | Not applicable | No public exploit | In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash. |
| CVE-2024-11149 | Medium | 2024-12-06 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs. |
| CVE-2024-11148 | High | 2024-12-05 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request. |
| CVE-2024-10933 | Medium | 2024-12-05 | Not applicable | No public exploit | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems. |
| CVE-2024-10934 | Critical | 2024-11-15 | Not applicable | No public exploit | In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server. |
| CVE-2021-35000 | Low | 2024-05-07 | Not applicable | No public exploit | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-16112. |
| CVE-2021-34999 | Medium | 2024-05-07 | Not applicable | No public exploit | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-14540. |
| CVE-2024-29937 | Critical | 2024-04-11 | Not applicable | No public exploit | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption. |
| CVE-2023-52558 | High | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences. |
| CVE-2023-52557 | High | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length. |
| CVE-2023-52556 | Medium | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic. |
| CVE-2023-51767 | High | 2023-12-24 | Not applicable | No public exploit | OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses." |
| CVE-2023-51384 | Medium | 2023-12-18 | Not applicable | No public exploit | In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. |
| CVE-2023-40216 | Medium | 2023-08-10 | Not applicable | No public exploit | OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences. |
| CVE-2023-35784 | Critical | 2023-06-16 | Not applicable | No public exploit | A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected. |
| CVE-2021-46880 | Critical | 2023-04-15 | Not applicable | No public exploit | x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes discarded. |
| CVE-2022-48437 | Medium | 2023-04-12 | Not applicable | No public exploit | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate. |
| CVE-2023-29323 | High | 2023-04-04 | Not applicable | No public exploit | ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address. |
| CVE-2023-28531 | Critical | 2023-03-17 | Not applicable | No public exploit | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. |
| CVE-2023-27567 | High | 2023-03-03 | Not applicable | No public exploit | In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. |
| CVE-2022-27882 | High | 2022-03-25 | Not applicable | No public exploit | slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow triggerable by a crafted IPv6 router advertisement. NOTE: privilege separation and pledge can prevent exploitation. |
| CVE-2022-27881 | High | 2022-03-25 | Not applicable | No public exploit | engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertisement with more than seven nameservers. NOTE: privilege separation and pledge can prevent exploitation. |
| CVE-2021-36368 | Low | 2022-03-13 | Not applicable | No public exploit | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed. |
| CVE-2021-41617 | High | 2021-09-26 | Outside Waratek scope | No public exploit | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. |
| CVE-2021-41581 | Medium | 2021-09-24 | Not applicable | No public exploit | x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination. |
| CVE-2016-20012 | Medium | 2021-09-15 | Outside Waratek scope | No public exploit | OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product |
| CVE-2019-25049 | High | 2021-07-01 | Not applicable | No public exploit | LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx). |
| CVE-2019-25048 | High | 2021-07-01 | Not applicable | No public exploit | LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print). |
| CVE-2010-4816 | High | 2021-06-22 | Not applicable | No public exploit | It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service. |
| CVE-2020-26142 | Medium | 2021-05-11 | Not applicable | No public exploit | An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration. |
| CVE-2021-28041 | High | 2021-03-05 | Not applicable | No public exploit | ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. |
| CVE-2020-16088 | Critical | 2020-07-28 | Not applicable | No public exploit | iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches. |
| CVE-2020-14145 | Medium | 2020-06-29 | Outside Waratek scope | No public exploit | The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. |
| CVE-2020-12062 | High | 2020-06-01 | Not applicable | No public exploit | The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances. |
| CVE-2015-5334 | Critical | 2020-01-23 | Not applicable | No public exploit | Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508. |
| CVE-2015-5333 | High | 2020-01-23 | Not applicable | No public exploit | Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates. |
| CVE-2012-5663 | High | 2019-12-30 | Not applicable | No public exploit | The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp). |
| CVE-2019-14899 | High | 2019-12-11 | Not applicable | No public exploit | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel. |
| CVE-2012-1577 | Critical | 2019-12-10 | Not applicable | No public exploit | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. |
| CVE-2019-19522 | High | 2019-12-05 | Not applicable | No public exploit | OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveraging membership in the auth group. This occurs because root's file can be written to /etc/skey or /var/db/yubikey, and need not be owned by root. |
| CVE-2019-19521 | Critical | 2019-12-05 | Not applicable | No public exploit | libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. This is related to gen/auth_subr.c and gen/authenticate.c in libc (and login/login.c and xenocara/app/xenodm/greeter/verify.c). |
| CVE-2019-19520 | High | 2019-12-05 | Not applicable | No public exploit | xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, because xenocara/lib/mesa/src/loader/loader.c mishandles dlopen. |
| CVE-2019-19519 | High | 2019-12-05 | Not applicable | No public exploit | In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the main function in su/su.c. |
| CVE-2019-16905 | High | 2019-10-09 | Outside Waratek scope | No public exploit | OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. |
| CVE-2019-8460 | High | 2019-08-26 | Not applicable | No public exploit | OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service. |
| CVE-2018-14775 | Medium | 2018-08-01 | Not applicable | No public exploit | tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture. |
| CVE-2018-12434 | Medium | 2018-06-15 | Not applicable | No public exploit | LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. |
| CVE-2018-8970 | High | 2018-03-24 | Not applicable | No public exploit | The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not. |
| CVE-2016-10708 | High | 2018-01-21 | Outside Waratek scope | No public exploit | sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. |
| CVE-2017-15906 | Medium | 2017-10-26 | Outside Waratek scope | No public exploit | The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. |
| CVE-2015-7687 | Critical | 2017-10-16 | Not applicable | No public exploit | Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta. |
| CVE-2017-1000372 | Critical | 2017-06-19 | Not applicable | No public exploit | A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. |
| CVE-2017-8301 | Medium | 2017-04-27 | Not applicable | No public exploit | LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx. |
| CVE-2016-1908 | Critical | 2017-04-11 | Not applicable | No public exploit | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server. |
| CVE-2016-6522 | Medium | 2017-03-07 | Not applicable | No public exploit | Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping. |
| CVE-2016-6350 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9. |
| CVE-2016-6247 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist. |
| CVE-2016-6246 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username, (2) groupname, or (3) device name of the root node. |
| CVE-2016-6245 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call. |
| CVE-2016-6244 | High | 2017-03-07 | Not applicable | No public exploit | The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_sec" value. |
| CVE-2016-6243 | Medium | 2017-03-07 | Not applicable | No public exploit | thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call. |
| CVE-2016-6242 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call. |
| CVE-2016-6241 | High | 2017-03-07 | Not applicable | No public exploit | Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value. |
| CVE-2016-6240 | High | 2017-03-07 | Not applicable | No public exploit | Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value. |
| CVE-2016-6239 | Medium | 2017-03-07 | Not applicable | No public exploit | The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value. |
| CVE-2016-10012 | High | 2017-01-05 | Not applicable | No public exploit | The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures. |
| CVE-2016-10011 | Medium | 2017-01-05 | Not applicable | No public exploit | authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process. |