Overview 149 matches · 0 in Waratek scope · 0 protected · 10 exploited · 1 CISA KEV · 31 public PoC · 11 EPSS ≥ 0.5
149matches
0in Waratek scope0.0%
0protected0.0%
10exploited6.7%
1CISA KEV0.7%
31public PoC20.8%
11EPSS ≥ 0.57.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
16
10.7%
Not applicable
133
89.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
149
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 30 / year
19991
Not applicable1
Low1
not blocked1
No public exploit1
20005
Not applicable5
High2
Medium3
not blocked5
Working exploit published1
No public exploit4
200113
Not applicable13
High9
Medium3
Low1
not blocked13
Working exploit published2
No public exploit11
20025
Not applicable5
Critical2
High3
not blocked5
Working exploit published3
No public exploit2
20038
Not applicable8
High7
Medium1
not blocked8
Working exploit published1
No public exploit7
20044
Not applicable4
Medium4
not blocked4
Exploited1
No public exploit3
20053
Not applicable3
Medium2
Low1
not blocked3
No public exploit3
20068
Not applicable8
High3
Medium4
Low1
not blocked8
Working exploit published2
Proof of concept only1
No public exploit5
20075
Outside Waratek scope1
Not applicable4
High1
Medium4
not blocked5
Exploited1
No public exploit4
20087
Not applicable7
High1
Medium4
Low2
not blocked7
Working exploit published1
Proof of concept only1
No public exploit5
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20101
Not applicable1
Critical1
not blocked1
No public exploit1
20112
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20122
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
20132
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20145
Outside Waratek scope1
Not applicable4
High1
Medium4
not blocked5
No public exploit5
20155
Not applicable5
High3
Medium2
not blocked5
Working exploit published1
No public exploit4
20167
Not applicable7
High4
Medium3
not blocked7
Working exploit published2
Proof of concept only1
Forecast only1
No public exploit3
20177
Outside Waratek scope1
Not applicable6
Critical1
High3
Medium3
not blocked7
Working exploit published3
No public exploit4
20183
Outside Waratek scope3
High1
Medium2
not blocked3
Working exploit published1
Proof of concept only1
No public exploit1
20196
Outside Waratek scope4
Not applicable2
High2
Medium4
not blocked6
Exploited4
No public exploit2
20203
Outside Waratek scope2
Not applicable1
High2
Medium1
not blocked3
Proof of concept only1
No public exploit2
20213
Outside Waratek scope2
Not applicable1
High2
Medium1
not blocked3
No public exploit3
20222
Not applicable2
High1
Low1
not blocked2
Proof of concept only1
No public exploit1
20237
Outside Waratek scope1
Not applicable6
Critical2
High1
Medium4
not blocked7
Exploited2
Proof of concept only2
No public exploit3
20241
Not applicable1
High1
not blocked1
Exploited1
20253
Outside Waratek scope1
Not applicable2
Medium3
not blocked3
Proof of concept only2
No public exploit1
202630
Not applicable30
Critical1
High9
Medium13
Low7
not blocked30
Exploited1
No public exploit29
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2007-2768 | Medium | 2007-05-21 | Outside Waratek scope | No public exploit | OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords (OTP), a similar issue to CVE-2007-2243. |
| CVE-2007-2243 | Medium | 2007-04-25 | Not applicable | No public exploit | OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483. |
| CVE-2006-5794 | High | 2006-11-08 | Not applicable | No public exploit | Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist. |
| CVE-2006-5229 | Low | 2006-10-10 | Not applicable | Working exploit published | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds. |
| CVE-2006-4925 | Medium | 2006-09-29 | Not applicable | No public exploit | packet.c in ssh in OpenSSH allows remote attackers to cause a denial of service (crash) by sending an invalid protocol sequence with USERAUTH_SUCCESS before NEWKEYS, which causes newkeys[mode] to be NULL. |
| CVE-2006-5052 | Medium | 2006-09-27 | Not applicable | No public exploit | Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort." |
| CVE-2006-5051 | High | 2006-09-27 | Not applicable | Proof of concept only | Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free. |
| CVE-2006-4924 | High | 2006-09-27 | Not applicable | Working exploit published | sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector. |
| CVE-2006-0883 | Medium | 2006-03-07 | Not applicable | No public exploit | OpenSSH on FreeBSD 5.3 and 5.4, when used with OpenPAM, does not properly handle when a forked child process terminates during PAM authentication, which allows remote attackers to cause a denial of service (client connection refusal) by connecting multiple times to the SSH server, waiting for the password prompt, then disconnecting. |
| CVE-2006-0225 | Medium | 2006-01-25 | Not applicable | No public exploit | scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice. |
| CVE-2005-2798 | Medium | 2005-09-06 | Not applicable | No public exploit | sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts. |
| CVE-2005-2797 | Medium | 2005-09-06 | Not applicable | No public exploit | OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality. |
| CVE-2005-2666 | Low | 2005-08-23 | Not applicable | No public exploit | SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key. |
| CVE-2004-2760 | Medium | 2004-12-31 | Not applicable | No public exploit | sshd in OpenSSH 3.5p1, when PermitRootLogin is disabled, immediately closes the TCP connection after a root login attempt with the correct password, but leaves the connection open after an attempt with an incorrect password, which makes it easier for remote attackers to guess the password by observing the connection state, a different vulnerability than CVE-2003-0190. NOTE: it could be argued that in most environments, this does not cross privilege boundaries without requiring leverage of a separate vulnerability. |
| CVE-2004-2069 | Medium | 2004-12-31 | Not applicable | No public exploit | sshd.c in OpenSSH 3.6.1p2 and 3.7.1p2 and possibly other versions, when using privilege separation, does not properly signal the non-privileged process when a session has been terminated after exceeding the LoginGraceTime setting, which leaves the connection open and allows remote attackers to cause a denial of service (connection consumption). |
| CVE-2004-1653 | Medium | 2004-08-31 | Not applicable | Exploited | The default configuration for OpenSSH enables AllowTcpForwarding, which could allow remote authenticated users to perform a port bounce, when configured with an anonymous access program such as AnonCVS. |
| CVE-2004-0175 | Medium | 2004-08-18 | Not applicable | No public exploit | Directory traversal vulnerability in scp for OpenSSH before 3.4p1 allows remote malicious servers to overwrite arbitrary files. NOTE: this may be a rediscovery of CVE-2000-0992. |
| CVE-2003-1562 | High | 2003-12-31 | Not applicable | No public exploit | sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190. |
| CVE-2003-0787 | High | 2003-11-17 | Not applicable | No public exploit | The PAM conversation function in OpenSSH 3.7.1 and 3.7.1p1 interprets an array of structures as an array of pointers, which allows attackers to modify the stack and possibly gain privileges. |
| CVE-2003-0786 | High | 2003-11-17 | Not applicable | No public exploit | The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled, does not check the result of the authentication attempt, which can allow remote attackers to gain privileges. |
| CVE-2003-0695 | High | 2003-10-06 | Not applicable | No public exploit | Multiple "buffer management errors" in OpenSSH before 3.7.1 may allow attackers to cause a denial of service or execute arbitrary code using (1) buffer_init in buffer.c, (2) buffer_free in buffer.c, or (3) a separate function in channels.c, a different vulnerability than CVE-2003-0693. |
| CVE-2003-0682 | High | 2003-10-06 | Not applicable | No public exploit | "Memory bugs" in OpenSSH 3.7.1 and earlier, with unknown impact, a different set of vulnerabilities than CVE-2003-0693 and CVE-2003-0695. |
| CVE-2003-0693 | High | 2003-09-22 | Not applicable | No public exploit | A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to execute arbitrary code by causing an incorrect amount of memory to be freed and corrupting the heap, a different vulnerability than CVE-2003-0695. |
| CVE-2003-0386 | High | 2003-07-02 | Not applicable | No public exploit | OpenSSH 3.6.1 and earlier, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass "from=" and "user@host" address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address. |
| CVE-2003-0190 | Medium | 2003-05-12 | Not applicable | Working exploit published | OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. |
| CVE-2002-0765 | High | 2002-08-12 | Not applicable | No public exploit | sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password. |
| CVE-2002-0640 | High | 2002-07-03 | Not applicable | Working exploit published | Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large number of responses during challenge response authentication when OpenBSD is using PAM modules with interactive keyboard authentication (PAMAuthenticationViaKbdInt). |
| CVE-2002-0639 | Critical | 2002-07-03 | Not applicable | No public exploit | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResponseAuthentication) when OpenSSH is using SKEY or BSD_AUTH authentication. |
| CVE-2002-0575 | High | 2002-06-18 | Not applicable | Working exploit published | Buffer overflow in OpenSSH before 2.9.9, and 3.x before 3.2.1, with Kerberos/AFS support and KerberosTgtPassing or AFSTokenPassing enabled, allows remote and local authenticated users to gain privileges. |
| CVE-2002-0083 | Critical | 2002-03-15 | Not applicable | Working exploit published | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. |
| CVE-2001-1585 | Medium | 2001-12-31 | Not applicable | No public exploit | SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02-08, does not perform a challenge-response step to ensure that the client has the proper private key, which allows remote attackers to bypass authentication as other users by supplying a public key from that user's authorized_keys file. |
| CVE-2001-1507 | High | 2001-12-31 | Not applicable | No public exploit | OpenSSH before 3.0.1 with Kerberos V enabled does not properly authenticate users, which could allow remote attackers to login unchallenged. |
| CVE-2001-0872 | High | 2001-12-21 | Not applicable | No public exploit | OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain root privileges. |
| CVE-2001-0816 | High | 2001-12-06 | Not applicable | No public exploit | OpenSSH before 2.9.9, when running sftp using sftp-server and using restricted keypairs, allows remote authenticated users to bypass authorized_keys2 command= restrictions using sftp commands. |
| CVE-2001-1380 | High | 2001-10-18 | Not applicable | No public exploit | OpenSSH before 2.9.9, while using keypairs and multiple keys of different types in the ~/.ssh/authorized_keys2 file, may not properly handle the "from" option associated with a key, which could allow remote attackers to login from unauthorized IP addresses. |
| CVE-2001-1382 | Medium | 2001-09-27 | Not applicable | No public exploit | The "echo simulation" traffic analysis countermeasure in OpenSSH before 2.9.9p2 sends an additional echo packet after the password and carriage return is entered, which could allow remote attackers to determine that the countermeasure is being used. |
| CVE-2001-1029 | Low | 2001-09-20 | Not applicable | Working exploit published | libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files. |
| CVE-2001-0572 | High | 2001-08-22 | Not applicable | No public exploit | The SSH protocols 1 and 2 (aka SSH-2) as implemented in OpenSSH and other packages have various weaknesses which can allow a remote attacker to obtain the following information via sniffing: (1) password lengths or ranges of lengths, which simplifies brute force password guessing, (2) whether RSA or DSA authentication is being used, (3) the number of authorized_keys in RSA authentication, or (4) the lengths of shell commands. |
| CVE-2001-0529 | High | 2001-08-14 | Not applicable | No public exploit | OpenSSH version 2.9 and earlier, with X forwarding enabled, allows a local attacker to delete any file named 'cookies' via a symlink attack. |
| CVE-2001-0361 | Medium | 2001-06-27 | Not applicable | No public exploit | Implementations of SSH version 1.5, including (1) OpenSSH up to version 2.3.0, (2) AppGate, and (3) ssh-1 up to version 1.2.31, in certain configurations, allow a remote attacker to decrypt and/or alter traffic via a "Bleichenbacher attack" on PKCS#1 version 1.5. |
| CVE-2001-1459 | High | 2001-06-19 | Not applicable | No public exploit | OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module (PAM) session if commands are executed with no pty, which allows local users to bypass resource limits (rlimits) set in pam.d. |
| CVE-2001-0144 | High | 2001-03-12 | Not applicable | Working exploit published | CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow. |
| CVE-2000-1169 | High | 2001-01-09 | Not applicable | No public exploit | OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH server to gain access to the X11 display and sniff X11 events, or gain access to the ssh-agent. |
| CVE-2000-0992 | Medium | 2000-12-19 | Not applicable | Working exploit published | Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack. |
| CVE-2000-0999 | High | 2000-12-11 | Not applicable | No public exploit | Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers to gain root privileges. |
| CVE-2000-0525 | High | 2000-06-08 | Not applicable | No public exploit | OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute arbitrary commands by providing the command to the ssh daemon. |
| CVE-2000-0217 | Medium | 2000-02-24 | Not applicable | No public exploit | The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program. |
| CVE-2000-0143 | Medium | 2000-02-11 | Not applicable | No public exploit | The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP. |
| CVE-1999-1010 | Low | 1999-12-14 | Not applicable | No public exploit | An SSH 1.2.27 server allows a client to use the "none" cipher, even if it is not allowed by the server policy. |