478 matches found
sshole
openssh on musl linux alpine, openwrt, buildroot, yocto lets you log in to any account that has as its password with any password longer than 256 characters. that means root, key-only users, ldap users, the alpine user on alpine's cloud images. since 2016. the full story is at sshhole.com. this...
extloader
extLoader A small toolkit for managing and deploying unpacked Chromium extensions. Find out more in the following blogpost: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways Installation Direct install pipx pipx install . extloader --hel...
kentico-xperience13-AuthBypass-wt-2025-0006
WT-2025-0006 CVE not assigned yet Kentico Xperience 13 CMS - Staging Service Authentication Bypass Check Detection in Action python3 watchTowr-vs-kentico-xperience13-AuthBypass-wt-2025-0006.py -H http://labcms / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // ||...
enumpossible
enumpossible Checks a list of SSH servers for password-based auth availability and for the existence of SSH user enumeration vulnerability CVE-2018-15473 in those identified. Uses a slightly modified version of https://www.exploit-db.com/exploits/45939 by @LeapSecurity to check for CVE-2018-15473...
CVE-2023-50564
CVE-2023-50564 How to use First setup a listener for the reverse shell. Terminal 1 nc -nlvp Execute the script which will attempt to install a pluck module sending the reverse shell back to us. Terminal 2 go run exploit.go -url -password -i -p...
Exploit for Unexpected Status Code or Return Value in Openbsd Openssh
CVE-2026-123158 "sshole" — Lab de estudo Laboratório local,...
Exploit for Unexpected Status Code or Return Value in Openbsd Openssh
CVE-2026-123158 “sshole” OpenSSH/musl password authenticatio...
OpenSSH CVE-2026-123158 SSHole auth bypass
CVE-2026-123158 SSHole: OpenSSH on musl Linux without PAM may accept password authentication for accounts with shadow field when the client sends a 257–1024 byte password. On success, registers an SSH session via the framework handler. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSSH musl...
SUSE CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...
K000164144: OpenSSH vulnerability CVE-2026-123158
Security Advisory Description sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password...
Vulnerability fixed in OpenSSH by the OpenSSH Project
The OpenSSH project has addressed a vulnerability in sshd on OpenSSH versions older than 10.6p2. The vulnerability affects Linux systems that use musl libc and do not employ PAM. It involves bypassing SSH password authentication when using passwords with lengths ranging from 257 to 1024 bytes. Th...
CVE-2026-123158
A flaw was found in OpenSSH. When running on Linux systems utilizing the musl standard C library without Pluggable Authentication Modules PAM, the SSH server can misinterpret input strings as password hashes. A remote, unauthenticated attacker can exploit this flaw by submitting a specially sized...
VulnCheck KEV: CVE-2026-123158
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass...
Linux Distros Unpatched Vulnerability : CVE-2026-123158
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation...
OpenSSH < 10.6p2 Authentication Bypass
The version of OpenSSH installed on the remote host is prior to 10.6p2. It is, therefore, affected by an authentication bypass vulnerability as referenced in the release-10.6p2 advisory. - sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a passwor...
UBUNTU-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...
CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...
AZL-112871 CVE-2026-123158 affecting package openssh 9.8p1-11
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...
DEBIAN-CVE-2026-123158
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...