Ssh vulnerabilities, page 2
48 vulnerabilities
Known vulnerabilities in Ssh products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.
CVE-2001-0144openbsdopenssh+1
EPSS score32.42%
CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow.CVE-2005-2146sshtectia_serverEPSS score0.31%
SSH Tectia Server 4.3.1 and earlier, and SSH Secure Shell for Windows Servers, uses insecure permissions when generating the Secure Shell host identification key, which allows local users to access the key and spoof the server.CVE-2005-4310sshtectia_serverEPSS score1.40%
SSH Tectia Server 5.0.0 (A, F, and T), when allowing host-based authentication only, allows users to log in with the wrong credentials.CVE-2008-5161debianopenssh+10EPSS score18.55%
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors.CVE-2012-5975sshtectia_serverEPSS score35.87%
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.CVE-2000-0575sshsshEPSS score0.84%
SSH 1.2.27 with Kerberos authentication support stores Kerberos tickets in a file which is created in the current directory of the user who is logging in, which could allow remote attackers to sniff the ticket cache if the home directory is installed on NFS.CVE-2000-0217openbsdopenssh+2EPSS score0.97%
The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.CVE-2000-0992debianopenssh+2EPSS score6.05%
Directory traversal vulnerability in scp in sshd 1.2.xx allows a remote malicious scp server to overwrite arbitrary files via a .. (dot dot) attack.CVE-2000-0143openbsdopenssh+1EPSS score0.35%
The SSH protocol server sshd allows local users without shell access to redirect a TCP connection through a service that uses the standard system password database for authentication, such as POP or FTP.CVE-2011-0766debianerlang+3EPSS score3.07%
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.CVE-1999-1231sshssh2EPSS score1.46%
ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once, which allows remote attackers to determine user account names on the server.CVE-1999-1159sshssh2EPSS score0.34%
SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root.CVE-1999-1029sshssh2EPSS score1.57%
SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs.CVE-1999-1085sshsecure_shellEPSS score3.50%
SSH 1.2.25, 1.2.23, and other versions, when used in in CBC (Cipher Block Chaining) or CFB (Cipher Feedback 64 bits) modes, allows remote attackers to insert arbitrary data into an existing stream between an SSH client and server by using a known plaintext attack and computing a valid CRC-32 checksum for the packet, aka the "SSH insertion attack."CVE-1999-0013sshsshEPSS score1.14%
Stolen credentials from SSH clients via ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user.CVE-1999-0248sshsshEPSS score1.60%
A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials.CVE-1999-0398sshssh+1EPSS score0.39%
In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login.CVE-1999-0787sshsshEPSS score1.01%
The SSH authentication agent follows symlinks via a UNIX domain socket.CVE-1999-0310sshsshEPSS score1.52%
SSH 1.2.25 on HP-UX allows access to new user accounts.CVE-2024-30170sshprivxEPSS score0.61%
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,