CVE-2024-3094

🚨 CVE-2024-3094 — XZ Utils Backdoor 🧠 Overview CVE-2024-3094 is a critical supply chain compromise affecting the widely used XZ Utils compression library. A malicious actor inserted a stealth backdoor into upstream releases, enabling remote code execution RCE via tampered liblzma. ⚠️ This...

cve-2024-6387-poc

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd...

CVE-2026-77185

A flaw was found in Apache MINA SSHD. When a Secure Shell SSH server implements the asynchronous authentication feature, a logic error in signature verification can result in public-key or host-based authentication checks being skipped. A remote, unauthenticated attacker can exploit this flaw to...

CVE-2024-3094-info

CVE-2024-3094-info https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin response https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

CVE-2024-6387

CVE-2024-6387 - PoC 📜 Description Note: This script is a quick prototype PoC, expect some errors and bugs may occur. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 Remote Unauthenticated Code Execution Vulnerability in OpenSSH server A signal handler race condition was found in OpenSSH's server...

openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity...

openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts

A flaw was found in OpenSSH's Secure Shell Daemon sshd. This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using...

CVE-2023-25136

CVE-2023-25136 Looking into the memory when sshd 9.1p1 aborts due to a double free bug. The pdf has some images that are rather blurry. I will update it soon for better legibility...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

cve-2024-6387-poc

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd...

openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory

A flaw was found in OpenSSH. The sshd component has an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server is in a Windows Active Directory environment. This could lead to unintended information disclosure and impact data integrity...

openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts

A flaw was found in OpenSSH's Secure Shell Daemon sshd. This vulnerability allows a remote attacker to cause a denial of service by initiating an excessive number of authentication attempts. The issue arises from the mishandling of the MaxAuthTries setting specifically when using...

3snake

3snake - dump sshd and sudo credential related strings Disclaimer I Wrote This In College About Targeting rooted servers, reads memory from sshd and sudo system calls that handle password based authentication. Doesn't write any memory to the traced processes. Spawns a new process for every sshd a...

CVE-2024-6387-POC

cve-2024-6387-poc a signal handler race condition in OpenSSH's server sshd...

CVE-2024-6387

Vulnerability Description CVE-2024-6387 exploit targets a signal handler race condition in the OpenSSH server sshd on glibc-based Linux systems. Due to calling an async-signal-unsafe function in the SIGALRM handler, this vulnerability allows remote code execution as root. Vulnerability Summary Th...

CVE-2018-6574

CVE-2018-6574...

CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon sshd incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by...

CVE-2026-106588

A flaw was found in OpenSSH. When built using certain macOS software development kits SDKs, the SSH server daemon sshd disables process sandboxing due to the removal of underlying system interfaces. Consequently, the daemon runs without sandbox isolation, potentially allowing an attacker who...

apache__mina-sshd_CVE-2023-35887_2-9-2

Apache MINA SSHD Apache MINA SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. It does not aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH...

CVE-2024-6387-Race-Condition-in-Signal-Handling-for-OpenSSH

CVE-2024-6387: Race Condition in Signal Handling for OpenSSH Overview CVE-2024-6387 is a critical vulnerability discovered in OpenSSH's server sshd that allows an attacker to potentially achieve unauthenticated remote code execution RCE as root. The vulnerability arises from a race condition in t...