Overview 40 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 8 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
5.0%
Not applicable
38
95.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
40
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
40
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 7 / year
19991
Not applicable1
Low1
not blocked1
Working exploit published1
20001
Not applicable1
Medium1
not blocked1
Working exploit published1
20015
Not applicable5
High3
Low2
not blocked5
Working exploit published5
20025
Not applicable5
Critical1
High4
not blocked5
Working exploit published5
20031
Not applicable1
Medium1
not blocked1
Working exploit published1
20040
20051
Not applicable1
High1
not blocked1
Working exploit published1
20065
Not applicable5
High3
Medium1
Low1
not blocked5
Working exploit published5
20070
20087
Not applicable7
High4
Medium3
not blocked7
Working exploit published7
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20110
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20140
20151
Not applicable1
High1
not blocked1
Working exploit published1
20163
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20173
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20182
Outside Waratek scope2
Critical1
Medium1
not blocked2
Working exploit published2
20190
20201
Not applicable1
High1
not blocked1
Working exploit published1
20210
20220
20230
20242
Not applicable2
High2
not blocked2
Working exploit published2
200020032006200920122015201820212024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-0725 | High | 2024-01-19 | Not applicable | Working exploit published | A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251548. |
| CVE-2024-0723 | High | 2024-01-19 | Not applicable | Working exploit published | A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251547. |
| CVE-2020-9283 | High | 2020-02-20 | Not applicable | Working exploit published | golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client. |
| CVE-2018-10933 | Critical | 2018-10-17 | Outside Waratek scope | Working exploit published | A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access. |
| CVE-2018-15473 | Medium | 2018-08-17 | Outside Waratek scope | Working exploit published | OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. |
| CVE-2016-6210 | Medium | 2017-02-13 | Not applicable | Working exploit published | sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided. |
| CVE-2016-10010 | High | 2017-01-05 | Not applicable | Working exploit published | sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c. |
| CVE-2016-10009 | High | 2017-01-05 | Not applicable | Working exploit published | Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket. |
| CVE-2016-6515 | High | 2016-08-07 | Not applicable | Working exploit published | The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string. |
| CVE-2016-3116 | Medium | 2016-03-22 | Not applicable | Working exploit published | CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. |
| CVE-2016-3115 | Medium | 2016-03-22 | Not applicable | Working exploit published | Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. |
| CVE-2015-6565 | High | 2015-08-24 | Not applicable | Working exploit published | sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal disruption) or possibly have unspecified other impact by writing to a device, as demonstrated by writing an escape sequence. |
| CVE-2012-6066 | High | 2012-12-04 | Not applicable | Working exploit published | freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c. |
| CVE-2008-6899 | High | 2009-08-05 | Not applicable | Working exploit published | Multiple buffer overflows in freeSSHd 1.2.1 allow remote authenticated users to cause a denial of service (crash) and execute arbitrary code via a long (1) open, (2) unlink, (3) mkdir, (4) rmdir, or (5) stat SFTP command. |
| CVE-2008-4762 | High | 2008-10-28 | Not applicable | Working exploit published | Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service crash) and potentially execute arbitrary code via a long argument to the (1) rename and (2) realpath parameters. |
| CVE-2008-4726 | High | 2008-10-24 | Not applicable | Working exploit published | Stack-based buffer overflow in the SFTP subsystem in GoodTech SSH 6.4 allows remote authenticated users to execute arbitrary code via a long string to the (1) open (aka SSH_FXP_OPEN), (2) unlink, (3) opendir, and other unspecified parameters. |
| CVE-2008-3234 | Medium | 2008-07-18 | Not applicable | Working exploit published | sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username. |
| CVE-2008-2573 | High | 2008-06-06 | Not applicable | Working exploit published | Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a long directory name in an SSH_FXP_OPENDIR (aka opendir) command. |
| CVE-2008-0852 | Medium | 2008-02-21 | Not applicable | Working exploit published | freeSSHd 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a SSH2_MSG_NEWKEYS packet to TCP port 22, which triggers a NULL pointer dereference. |
| CVE-2008-0132 | Medium | 2008-01-08 | Not applicable | Working exploit published | Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for the administrator to click in this window before terminating the sshd.exe process, which allows remote attackers to cause a denial of service (connection slot exhaustion) via a flood of SSH connections with long data objects, as demonstrated by (1) a long list of keys and (2) a long username. |
| CVE-2008-0096 | High | 2008-01-08 | Not applicable | Working exploit published | Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code via a (1) a long username, which triggers an overflow in the log function; or (2) a long password. |
| CVE-2006-6243 | High | 2006-12-04 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in index.asp in FipsSHOP allow remote attackers to execute arbitrary SQL commands via the (1) cat or (2) did parameter. |
| CVE-2006-5229 | Low | 2006-10-10 | Not applicable | Working exploit published | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds. |
| CVE-2006-4924 | High | 2006-09-27 | Not applicable | Working exploit published | sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector. |
| CVE-2006-2407 | High | 2006-05-16 | Not applicable | Working exploit published | Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string. |
| CVE-2006-1206 | Medium | 2006-03-14 | Not applicable | Working exploit published | Matt Johnston Dropbear SSH server 0.47 and earlier, as used in embedded Linux devices and on general-purpose operating systems, allows remote attackers to cause a denial of service (connection slot exhaustion) via a large number of connection attempts that exceeds the MAX_UNAUTH_CLIENTS defined value of 30. |
| CVE-2004-1161 | High | 2005-01-10 | Not applicable | Working exploit published | rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions and execute arbitrary programs via (1) rdist -P, (2) rsync, or (3) scp -S. |
| CVE-2003-0190 | Medium | 2003-05-12 | Not applicable | Working exploit published | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. |
| CVE-2002-1715 | High | 2002-12-31 | Not applicable | Working exploit published | SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then executing that script to gain normal shell access. |
| CVE-2002-1359 | High | 2002-12-23 | Not applicable | Working exploit published | Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite. |
| CVE-2002-0640 | High | 2002-07-03 | Not applicable | Working exploit published | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt). |
| CVE-2002-0575 | High | 2002-06-18 | Not applicable | Working exploit published | Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges. |
| CVE-2002-0083 | Critical | 2002-03-15 | Not applicable | Working exploit published | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. |
| CVE-2001-1029 | Low | 2001-09-20 | Not applicable | Working exploit published | libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files. |
| CVE-2001-0471 | High | 2001-06-27 | Not applicable | Working exploit published | SSH daemon version 1 (aka SSHD-1 or SSH-1) 1.2.30 and earlier does not log repeated login attempts, which could allow remote attackers to compromise accounts without detection via a brute force attack. |
| CVE-2001-0259 | Low | 2001-06-02 | Not applicable | Working exploit published | ssh-keygen in ssh 1.2.27 - 1.2.30 with Secure-RPC can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private key file. |
| CVE-2001-0144 | High | 2001-03-12 | Not applicable | Working exploit published | CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow. |
| CVE-2001-1473 | High | 2001-01-18 | Not applicable | Working exploit published | The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target, but which uses a public key pair that is weaker than the target's public key, which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target. |
| CVE-2000-0992 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack. |
| CVE-1999-0787 | Low | 1999-09-17 | Not applicable | Working exploit published | The SSH authentication agent follows symlinks via a UNIX domain socket. |