Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,255 results · page 9 of 26
Jul 2, 2025The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH.CVE-2024-35164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.8
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
- Product
- Apache Guacamole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jun 24, 2025A flaw was found in the libssh library in versions less than 0.11.2.CVE-2025-5318 · Other software · Red Hat · reported by Red HatMedium 5.4
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 18, 2025The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box.CVE-2025-23170 · Other software · Versa · reported by support@hackerone.comMedium 6.7
The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
- Product
- Director
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-portal.versa-networks.comsupport.versa-networks.com
Jun 4, 2025A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-SerCVE-2025-20261 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.8
A vulnerability in the SSH connection handling of Cisco Integrated Management Controller (IMC) for Cisco UCS B-Series, UCS C-Series, UCS S-Series, and UCS X-Series Servers could allow an authenticated, remote attacker to access internal services with elevated privileges. This vulnerability is due to insufficient restrictions on access to internal services. An attacker with a valid user account could exploit this vulnerability by using crafted syntax when connecting to the Cisco IMC of an affected device through SSH. A successful exploit could allow the attacker to access internal services with elevated privileges, which may allow unauthorized modifications to the system, including the possibility of creating new administrator accounts on the affected device.
- Product
- Cisco Unified Computing System (Managed)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Jun 4, 2025A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate CiscoCVE-2025-20163 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.7
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.
- Product
- Cisco Data Center Network Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 21, 2025An OpenSSH daemon listens on TCP port 22.CVE-2025-48416 · Other software · eCharge Hardy Barth · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.1
An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
- Product
- cPH2 / cPP2 charging stations
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comseclists.org
May 13, 2025Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.CVE-2025-4658 · Other software · OPKSSH · reported by cna@cloudflare.comCritical 9.3
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPubkey library for authentication, this vulnerability in OpenPubkey also applies to OPKSSH versions prior to 0.5.0 and would allow an attacker to bypass OPKSSH authentication.
- Product
- OPKSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.CVE-2025-3757 · Other software · OPKSSH · reported by cna@cloudflare.comCritical 9.3
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.
- Product
- OPKSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.CVE-2025-28202 · Other software · Govicture · reported by MITREHigh 8.8
Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.
- Product
- Rx1800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; accesCVE-2025-36546 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.2
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability they must obtain the root user's SSH private key. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- F5OS - Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.CVE-2025-47203 · Other software · Dropbear SSH Project · reported by MITREMedium 4.5
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.
- Product
- Dropbear SSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components toCVE-2025-4041 · Other software · Optigo Networks · reported by ics-cert@hq.dhs.govCritical 9.3
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
- Product
- ONS NC600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmationCVE-2025-43014 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.1
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possibleCVE-2025-43013 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.9
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possibleCVE-2025-43012 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.3
In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025In JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginCVE-2025-42921 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.2
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
- Product
- Toolbox App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining cCVE-2025-2903 · Other software · Perforce · reported by security@puppet.comHigh 8.5
An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.
- Product
- Delphix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityCVE-2025-32433 · Other software · Erlang · reported by GitHubExploitedCritical 10
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
- Product
- Erlang/OTP
- On CISA’s list since
- Jun 9, 2025 (federal fix deadline Jun 30, 2025)
- What to do
- Attackers are using this now. Install Erlang’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 15, 2025In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-serCVE-2023-5616 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 4.9
In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.
- Product
- Ubuntu's gnome-control-center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Apr 10, 2025In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on imCVE-2025-32755 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
- Product
- Jenkins jenkins/ssh-slave Docker images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based onCVE-2025-32754 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
- Product
- Jenkins jenkins/ssh-agent Docker images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2025In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.CVE-2025-32728 · Other software · OpenBSD · reported by MITREMedium 4.3
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.openbsd.orggithub.com
Apr 8, 2025Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.CVE-2025-27731 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper input validation in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access tCVE-2025-3364 · Other software · HGiga · reported by twcert@cert.org.twMedium 6.7
The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access the entire file system.
- Product
- PowerStation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 25, 2025An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker froCVE-2024-45482 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.5
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to auCVE-2024-45481 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.5
An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client.CVE-2024-12777 · Other software · aimhubio · reported by security@huntr.devMedium 5.9
A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests.
- Product
- aimhubio/aim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone imageCVE-2025-30234 · Other software · MNX · reported by MITREHigh 8.3
SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Debian 12 LX zone image from 2024-07-26).
- Product
- SmartOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.tritondatacenter.comsmartos.topicbox.com
Mar 17, 2025A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisoCVE-2019-17659 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 3.7
A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image.
- Product
- FortiSIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Mar 13, 2025Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password CVE-2025-2277 · Other software · Devolutions · reported by security@devolutions.netHigh 7.5
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serverCVE-2025-27256 · Other software · GE Vernova · reported by prodsec@nozominetworks.comHigh 8.3
Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH server authentication. Since the client connection is not authenticated, an attacker may perform a man-in-the-middle attack on the network.
- Product
- EnerVista UR Setup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgevernova.comnozominetworks.com
Mar 5, 2025Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.CVE-2024-53458 · Other software · Sysax · reported by MITREHigh 7.5
Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.
- Product
- Multi Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstorm.news
Feb 28, 2025A flaw was found in the OpenSSH package.CVE-2025-26466 · Other software · Red Hat · reported by Red HatMedium 5.9
A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 26, 2025SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at CVE-2025-22869 · Other software · golang.org/x/crypto · reported by security@golang.orgHigh 7.5
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled.CVE-2025-26465 · Other software · Red Hat · reported by Red HatMedium 6.8
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
- Product
- Red Hat Enterprise Linux 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Feb 14, 2025Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.CVE-2024-4282 · Other software · Brocade · reported by sirt@brocade.comHigh 8.2
Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credCVE-2025-1143 · Other software · Billion Electric · reported by twcert@cert.org.twHigh 8.4
Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
- Product
- M100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jan 31, 2025SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a pCVE-2024-47857 · Other software · reported by MITRECritical 9.8
SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH connections via a proxy port. This allows an existing PrivX "account A" to impersonate another existing PrivX "account B" and gain access to SSH target hosts to which the "account B" has access.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the hCVE-2024-48460 · Other software · reported by MITREMedium 4.3
An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictionsCVE-2025-22968 · Other software · Dlink · reported by MITRECritical 9.8
An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions
- Product
- Dwr-m972v Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH.CVE-2024-57811 · Other software · reported by MITRECritical 9.1
In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the firmware. NOTE: This vulnerability appears in versions that are no longer supported by Eaton.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on aCVE-2024-53705 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
A Server-Side Request Forgery vulnerability in the SonicOS SSH management interface allows a remote attacker to establish a TCP connection to an IP address on any port when the user is logged in to the firewall.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Dec 19, 2024A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).CVE-2024-12728 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2024Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH.CVE-2024-28980 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- RecoverPoint for Virtual Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorizationCVE-2024-45337 · Other software · golang.org/x/crypto · reported by security@golang.orgCritical 9.1
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since th
- Product
- golang.org/x/crypto/ssh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.CVE-2024-12286 · Other software · MOBATIME · reported by ics-cert@hq.dhs.govCritical 9.3
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
- Product
- Network Master Clock - DTS 4801
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2024MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.CVE-2024-55560 · Other software · mailcleaner · reported by MITRECritical 9.8
MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.
- Product
- mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh cCVE-2024-52308 · Other software · cli · reported by GitHubHigh 8
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf773
- Product
- cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script.CVE-2023-34049 · Other software · Salt · reported by security@vmware.comMedium 6.7
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
- Product
- SALT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Visual Studio Code Remote Extension Elevation of Privilege VulnerabilityCVE-2024-49049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
- Product
- Visual Studio Code Remote - SSH Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.