237 matches found
authkeysync
AuthKeySync Automatically synchronize SSH public keys from remote URLs to your servers 📖 Full Documentation The Problem Managing SSH access across multiple servers is painful: Team members join or leave, and you need to update authorizedkeys on every server Developers rotate their SSH keys, and n...
CVE-2018-11235
CVE-2018-11235 Para empezar Para construir los contenedores Docker, use: root@kitploit: make docker Los siguientes comandos make deben ejecutarse en paralelo en diferentes terminales desde su máquina Para iniciar el contenedor del servidor atacante, use: root@kitploit: make runserver para iniciar...
fortipwn
fortipwn Script de enumeración de Forti CVE-2022-40684 escrito en Rust. Sube una clave pública SSH a authorizedkeys, lo que permite a un atacante conectarse por SSH a un servidor que ejecute FortiOS como admin. Uso root@kitploit: $ ./fortipwn Compilación root@kitploit: $ git clone...
cve-2026-11837-ansible-posix-authorized-key
CVE-2026-11837: escalada de privilegios local en authorizedkey de ansible.posix Escalada de privilegios local en el módulo Ansible ansible.posix.authorizedkey mediante chown que sigue enlaces simbólicos y creación de archivos que sigue enlaces simbólicos en el directorio /.ssh del usuario y el...
Astra Linux – Vulnerability in rsync
A vulnerability was discovered in rsync prior to version 3.2.5. This vulnerability allows malicious remote servers to write arbitrary files into the directories of connecting peers. The server determines which files/directories are sent to the client. However, the rsync client lacks sufficient...
Astra Linux – Vulnerability in python-pip
The pip package before version 19.2 for Python allows Directory Traversal when a URL is provided in an install command. This is possible because the Content-Disposition header can contain "../ in the filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This behavior occurs...
Astra Linux – Vulnerability in OpenSSH
OpenSSH versions prior to 10.3 mishandle the authorizedkeys principals option in unusual scenarios where a principals list is used in conjunction with a Certificate Authority that utilizes comma characters...
K000163055: OpenSSH vulnerabilities CVE-2026-35386 and CVE-2026-35414
Security Advisory Description CVE-2026-35386 In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in...
Malicious code in fast-glob-fast (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408 fast-glob-fast is a name-squat of the popular fast-glob package its repository field even points at mrmlnc/fast-glob. The declared postinstall hook...
SUSE CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
JLSEC-2026-1329 In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be...
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
CVE-2026-73664
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...
CVE-2026-73664 FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorizedkeys for the asterisk system user without reliably enforcing backup-only...
OpenSSH < 10.5 Multiple Vulnerabilities
The version of OpenSSH installed on the remote host is prior to 10.5. It is, therefore, affected by multiple vulnerabilities as referenced in the release-10.5 advisory. - In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations a...
PT-2026-71885
FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized keys for the asterisk system user without reliably enforcing backup-only...
DEBIAN-CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
ALPINE-CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...
AZL-95532 CVE-2026-73283 affecting package openssh for versions less than 9.8p1-10
In sshd in OpenSSH before 10.5, the restrict keyword in authorizedkeys was supposed to be applicable to tunnel forwarding but was not...