410 matches found
CVE-2013-4706
The SSH implementation on the D-Link Japan DWL-2100AP with firmware before R252JP-RC572 allows remote authenticated users to cause a denial of service reboot by leveraging login access...
CVE-2012-4702
360 Systems Maxx, Image Server Maxx, and Image Server 2000 have a hardcoded password for the root account, which makes it easier for remote attackers to execute arbitrary code, or modify video content or scheduling, via an SSH session...
CVE-2013-4707
The SSH implementation on D-Link Japan DES-3810 devices with firmware before R2.20.011 allows remote authenticated users to cause a denial of service device hang by leveraging login access...
CVE-2003-0724
ssh on HP Tru64 UNIX 5.1B and 5.1A does not properly handle RSA signatures when digital certificates and RSA keys are used, which could allow local and remote attackers to gain privileges...
CVE-1999-0310
SSH 1.2.25 on HP-UX allows access to new user accounts...
Alibaba Cloud Linux 3 : 0014: libssh (ALINUX3-SA-2024:0014)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0014 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-48795: The SSH transport protocol with...
ALSA-2025:7484 Important: gvisor-tap-vsock security update
A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fixes: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of...
ALSA-2025:7462 Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144...
CVE-2025-46712
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...
CVE-2025-46712 Erlang/OTP SSH Has Strict KEX Violations
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...
CVE-2025-46712 Erlang/OTP SSH Has Strict KEX Violations
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...
CVE-2025-46712
CVE-2025-46712 describes an SSH handshake hardening bypass in Erlang/OTP: prior to OTP-27.3.4, OTP-26.2.5.12, and OTP-25.3.2.21, the SSH KEX handshake allows optional messages to be exchanged, enabling a MITM attacker to inject messages during the handshake. The issue has been patched in OTP-27.3...
CVE-2025-4041
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions...
PT-2025-20286
Name of the Vulnerable Software and Affected Versions: Dropbear SSH versions prior to 2025.88 Description: The issue allows command injection via an untrusted hostname argument, because a shell is used. This occurs when the dbclient in Dropbear SSH is used with an untrusted hostname...
PT-2025-19913 · Optigo Networks · Optigo Networks Ons Nc600
Name of the Vulnerable Software and Affected Versions: Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330 Description: An issue exists where an attacker could connect to the device's ssh server and utilize the system's components to perform OS command executions. Recommendations: For...
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only...
Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp
✅ Result The server responded to an SSH message ID 80 0x5...
📄 Erlang-Based SSH OTP Pre-Authentication Remote Code Execution
This Metasploit module detect and exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH servers that allows remote command execution. By sending crafted SSH packets, it executes a payload to establish a reverse shell on the target system. The exploit leverages a flaw in...