CVE-2017-9626

Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This update will restrict remote access by implementing SSH authentication...

Authentication flaw

Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This update will restrict remote access by implementing SSH authentication...

CVE-2017-9626

Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This update will restrict remote access by implementing SSH authentication...

CVE-2017-9626

CVE-2017-9626 affects Marel Pluto platform devices (Pluto-based applications) with improper access control that allowed unrestricted remote access. Connected sources confirm a Marel-generated update to restrict remote access by implementing SSH authentication, and ICS-CERT advisories describe thi...

CVE-2018-20799

In pfSense 2.4.41, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH authentication the behavior does not match the sshguard documentation, which might make it easier for attackers to bypass...

Making Expect scripts for SSH Authentication and Privilege Elevation

Expect can help you to automate interactive console applications. For example, expect script can go to some Linux host via SSH with password authentication, make additional authentication procedures su, sudo to elevate privileges and execute some commands. Like Vulnerability and Compliance...

EMC RecoverPoint command injection in SSH username

Added: 07/05/2018 CVE: CVE-2018-1235 BID: 104246 Background Dell EMC RecoverPoint is an application recovery solution. Problem A command injection vulnerability allows a remote attacker to execute arbitrary commands embedded in the username of an SSH authentication request. Resolution Upgrade to...

Marel Food Processing Systems (Update B)

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Marel Equipment: Food Processing Systems Vulnerabilities: Hard-Coded Passwords, Unrestricted Upload, Improper Access Control UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled...

Marel Food Processing Systems (Update A)

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Marel Equipment: Food Processing Systems Vulnerabilities: Hard-Coded Passwords, Unrestricted Upload, Improper Access Control UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

Uber: pam-ussh may be tricked into using another logged in user's ssh-agent

Summary https://github.com/uber/pam-ussh was open-sourced today kudos! and is presumably used within Uber's infrastructure. This is a PAM module written a Go that "will authenticate a user based on them having an ssh certificate in their ssh-agent signed by a specified ssh CA." A cursory look at...

[SECURITY] [DSA 3567-1] libpam-sshauth security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3567-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 04, 2016 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-3567-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Advantech EKI Vulnerable to Bypass, Possible Backdoor

Researchers have uncovered yet another issue–and potential backdoor–in Advantech’s beleaguered EKI-1322 serial device server. The Dropbear SSH daemon associated with the server, because of heavy modifications, fails to enforce authentication. This makes it so any user who wants to bypass...

RedHat Update for krb5 RHSA-2015:0794-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSH Communications Security SSH 1.2.27 Authentication Socket File Creation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/660/info A vulnerability in SSH's creation of the authentication agent UNIX domain socket allows local users to create a UNIX domain socket with an arbitrary file name in the system. SSH has the concept of authentication...

DenyHosts: Denial of service

Background DenyHosts is a script intended to be run by Linux system administrators to help thwart SSH server attacks. Description DenyHosts does not properly define the regular expressions used when parsing SSH authentication logs. Impact A remote attacker could possibly cause a Denial of Service...

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key

Loadbalancer.org Enterprise VA 7.5.2 - Static SSH Key ----------- Author: ----------- xistence ------------------------- Affected products: ------------------------- Loadbalancer.org Enterprise VA 7.5.2 and below ------------------------- Affected vendors: ------------------------- Loadbalancer.o...

freeFTPd 1.2.6 - Remote Authentication Bypass

FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting! Discovered & Exploited By Kingcope Year 2011 -- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23079.zip Example banner: WeOnlyDo-wodFTPD 2.3.6.165 This...

PuTTY SSH authentication password information disclosure vulnerability-vulnerability warning-the black bar safety net

Affected version: Simon Tatham PuTTY 0.61 Simon Tatham PuTTY 0.60 Simon Tatham PuTTY 0.59 Vulnerability description: BUGTRAQ ID: 51021PuTTY Windows and Unix platforms PuTTYTelnet and SSH implementation, with an xterm terminal emulator. PuTTY 0. 5 9 to 0. 6 1 version does not delete the...

Wing FTP Server "ssh public key"身份验证安全绕过漏洞

BUGTRAQ ID: 48335 Wing FTP服务器是安全的多协议文件服务器FTP, HTTP, FTPS, HTTPS, SFTP，适用于Windows, Linux, Mac OSX和Solaris。 Wing FTP服务器在SSH身份验证的实现上存在安全漏洞，恶意用户可利用此漏洞绕过某些安全限制。 此漏洞源于SSH身份验证机制中的错误，在限制到仅公钥身份验证时，可不顾配置的限制使用密码登录 wftpserve Wing FTP Server 3.8.7 wftpserve Wing FTP Server 3.8.6 wftpserve Wing FTP Server 3.8....