Security Bulletin: IBM Match 360 vulnerable to OpenSSH code execution (CVE-2024-6387)

Summary IBM Match 360 is vulnerable to remote OpenSSH code execution. OpenSSH could allow a remote attacker to execute arbitrary code on the system, caused by a signal handler race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary...

Advisory ROSA-SA-2025-2662

software: openssh 9.5 OS: ROSA-CHROME packageevrstring: openssh-9.5 CVE-ID: CVE-2023-51385 BDU-ID: 2023-08955 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the SSH protocol implementation of the OpenSSH cryptographic security tool is related to the introduction or modification of an argument...

Oracle Database Server (January 2025 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to...

Debian dla-3694 : openssh-client - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3694 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3694-1 [email protected]...

January 18, 2025—KB5052819 (OS Build 20348.3095) Out-of-band

None None...

Exploit for Double Free in Openbsd Openssh

OpenSSH Vulnerability Testing Tool for CVE-2023-25136 This re...

January 14, 2025—KB5049983 (OS Build 20348.3091)

None None...

Advisory ROSA-SA-2025-2551

Software: openssh 7.4p1 OS: rosa-server79 packageevrstring: openssh-7.4p1-23.0.6.res7 CVE-ID: CVE-2018-20685 BDU-ID: 2019-00773 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the OpenSSH cryptographic security tool is caused by errors in the validation of the scp.c directory name in the scp clien...

CVE-2023-25136 affecting package openssh 8.9p1-9

CVE-2023-25136 affecting package openssh 8.9p1-9. This CVE either no longer is or was never applicable...

CVE-2023-25136 affecting package openssh 8.9p1-3

CVE-2023-25136 affecting package openssh 8.9p1-3. This CVE either no longer is or was never applicable...

Exploit for Race Condition in Openbsd Openssh

Summary This is essentially a statistical vulnerability: a la...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387.py - PoC...

Security Bulletin: Vulnerability in openssh (CVE-2020-15778) affects Power HMC.

Summary The openssh library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2020-15778 DESCRIPTION: OpenSSH could allow a remote attacker to execute arbitrary commands on the system, caused by improper input validation in the...

December 10, 2024—KB5048661 (OS Build 17763.6659) - EXPIRED

None None...

OS command injection vulnerability in OpenSSH (CVE-2023-51385)

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or...

QNAP QuTS hero Multiple OpenSSH Vulnerabilities (QSA-24-37)

QNAP QuTS hero is prone to multiple vulnerabilities in OpenSSH. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero";...

QNAP QTS Multiple OpenSSH Vulnerabilities (QSA-24-37)

QNAP QTS is prone to multiple vulnerabilities in OpenSSH. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescriptio...

Astra Linux – Vulnerability in OpenSSH

OpenSSH versions 9.5 through 9.7 before 9.8 sometimes allow timing attacks against password entry processes such as echo-off password input e.g., for su and Sudo, due to a logical error in the ObscureKeystrokeTiming mechanism. Similarly, other timing attacks against keystroke input operations may...

Cisco Firepower Management Center Software RCE (cisco-sa-openssh-rce-2024)

A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Note that Nessu...

Cisco Firepower Management Center Software RCE (cisco-sa-openssh-rce-2024)

A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Note that Nessu...