Vulnerabilities > Dropbear SSH Project > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-18 | CVE-2023-48795 | Improper Validation of Integrity Check Value vulnerability in multiple products The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. network high complexity openbsd putty filezilla-project microsoft panic roumenpetrov winscp bitvise lancom-systems vandyke libssh net-ssh ssh2-project proftpd freebsd crates tera-term-project oryx-embedded crushftp netsarang paramiko redhat golang russh-project sftpgo-project erlang matez libssh2 asyncssh-project dropbear-ssh-project jadaptive ssh thorntech netgate connectbot apache tinyssh trilead 9bis gentoo fedoraproject debian apple CWE-354 | 5.9 |
| 2021-02-25 | CVE-2020-36254 | Unspecified vulnerability in Dropbear SSH Project Dropbear SSH scp.c in Dropbear before 2020.79 mishandles the filename of . network dropbear-ssh-project | 6.8 |
| 2020-12-30 | CVE-2019-12953 | Information Exposure vulnerability in Dropbear SSH Project Dropbear SSH Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599. | 5.0 |
| 2019-03-21 | CVE-2017-2659 | Improper Authentication vulnerability in Dropbear SSH Project Dropbear SSH It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. | 5.0 |
| 2018-08-21 | CVE-2018-15599 | Information Exposure vulnerability in multiple products The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase. | 5.0 |
| 2017-05-19 | CVE-2017-9079 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. | 4.7 |
| 2017-03-03 | CVE-2016-7408 | Improper Access Control vulnerability in Dropbear SSH Project Dropbear SSH The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. | 6.5 |
| 2016-03-22 | CVE-2016-3116 | Security Bypass vulnerability in Dropbear SSH CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. | 5.5 |
| 2013-10-25 | CVE-2013-4434 | Numeric Errors vulnerability in Dropbear SSH Project Dropbear SSH Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames. | 5.0 |
| 2013-10-25 | CVE-2013-4421 | Numeric Errors vulnerability in Dropbear SSH Project Dropbear SSH The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed. | 5.0 |