Important: nerdctl

Issue Overview: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to...

Amazon Linux 2 : containerd (ALASDOCKER-2025-049)

The version of containerd installed on the remote host is prior to 1.7.25-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-049 advisory. Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization...

Amazon Linux 2 : runfinch-finch (ALASDOCKER-2025-050)

The version of runfinch-finch installed on the remote host is prior to 1.6.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-050 advisory. 2025-02-12: CVE-2024-51744 was added to this advisory. 2025-02-12: CVE-2024-45338 was added to this advisory...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-049)

The version of containerd installed on the remote host is prior to 1.7.25-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-049 advisory. Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an...

Amazon Linux 2 : nerdctl (ALAS-2025-2749)

The version of nerdctl installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2749 advisory. Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization...

Amazon Linux 2 : containerd (ALASECS-2025-046)

The version of containerd installed on the remote host is prior to 1.7.25-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-046 advisory. Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization...

Security Bulletin: IBM Cloud Pak System is vulnerable to multiple vulnerabilities in Golang Go and Apache OpenSSH.

Summary IBM Cloud Pak System is vulnerable to multiple vulnerabilities in Golang Go and Apache OpenSSH. Vulnerability Details CVEID:CVE-2024-24785 DESCRIPTION: Golang Go could allow a remote attacker to bypass security restrictions, caused by a flaw in the MarshalJSON methods in the html/template...

Security Bulletin: Recommended mitigation for SSH "Terrapin" vulnerability in IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products

Summary The SSH "Terrapin" vulnerability affects IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products when using the [email protected] cipher. This cipher can be disabled with a chsecurity command to fix the vulnerability. Vulnerability Details...

SUSE-SU-2025:20003-1 Security update for util-linux

This update for util-linux fixes the following issues: Security issue fixed: - CVE-2024-28085: Properly neutralize escape sequences in wall to avoid potential account takeover. bsc1221831 Non-security issues fixed: - Fix hang of lscpu -e bsc1225598 - lscpu: Add more ARM cores bsc1223605 - Documen...

Security update for util-linux

This update for util-linux fixes the following issues: Security issue fixed: CVE-2024-28085: Properly neutralize escape sequences in wall to avoid potential account takeover. bsc1221831 Non-security issues fixed: Fix hang of lscpu -e bsc1225598 lscpu: Add more ARM cores bsc1223605 Document that...

Malicious code in pulumi-automation-sdk-ssh-tunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffa176b4dcf4483a947e659d4d4855bd174744d67a8ed98dadb4ddd425e41ea6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Path Traversal in Apache Http_Server

SSH Key and RCE PoC for CVE-2021-41773 This repository contai...

Race Condition

Overview parallel-ssh is an Asynchronous parallel SSH library Affected versions of this package are vulnerable to Race Condition in the scpsend function, leading to incomplete file transfers without error notifications. Remediation Upgrade parallel-ssh to version 2.9.1 or higher. References -...

addftool (>=0.2.7 <=0.3.2), autonet-cumulus (>=0.2.0 <=0.2.1) +19 more potentially affected by unknown CVE via parallel-ssh (>=2.12.0 <=2.9.0)

parallel-ssh PYPI version =2.12.0, =0.2.7, =0.2.0, =0.8.1.post1, =0.8.1.post1, =0.8.1.post1, =0.8.3.dev180, =0.11.0, =0.4.2, =2.1.1b1, =0.13.0a1, =0.14.1, =0.5.2, =0.1.0, =0.2.0, =1.0.0, =1.0.14 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-PARALLELSSH-8688146...

CVE-2024-47857

SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another existing PrivX "account B" and gain access to SSH target host...

CVE-2024-47857

SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another existing PrivX "account B" and gain access to SSH target host...

CVE-2024-47857

SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another existing PrivX "account B" and gain access to SSH target host...

PT-2025-2778 · Ssh Communications Security · Ssh Communication Security Privx

Name of the Vulnerable Software and Affected Versions: SSH Communication Security PrivX versions 18.0 through 36.0 Description: The issue is related to insufficient validation of public key signatures in SSH connections via a proxy port. This allows an existing account to impersonate another...

CVE-2024-47857

CVE-2024-47857 affects SSH Communication Security PrivX versions 18.0–36.0, where insufficient validation of public key signatures during native SSH connections via a proxy port allows an account (A) to impersonate another account (B) and access SSH targets that B can reach. This is documented ac...

MAL-2025-628 Malicious code in node-telegram-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64fa53b655e6444ccce46488f04d3dcf7f427354b64c286c652de18e947c2c74 Any computer that has this package installed or...