Vulnerabilities > Openbsd > Openssh > 3.7

DATE CVE VULNERABILITY TITLE RISK
2023-12-18 CVE-2023-51384 Unspecified vulnerability in Openbsd Openssh
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied.
local
low complexity
openbsd
5.5
2023-12-18 CVE-2023-51385 OS Command Injection vulnerability in multiple products
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations.
network
low complexity
openbsd debian CWE-78
6.5
2023-12-18 CVE-2023-48795 Improper Validation of Integrity Check Value vulnerability in multiple products
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack.
5.9
2023-07-20 CVE-2023-38408 Unquoted Search Path or Element vulnerability in multiple products
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system.
network
low complexity
openbsd fedoraproject CWE-428
critical
9.8
2022-03-13 CVE-2021-36368 Improper Authentication vulnerability in multiple products
An issue was discovered in OpenSSH before 8.9.
network
high complexity
openbsd debian CWE-287
3.7
2021-09-15 CVE-2016-20012 OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct.
network
low complexity
openbsd netapp
5.3
2020-07-24 CVE-2020-15778 OS Command Injection vulnerability in multiple products
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.
local
low complexity
openbsd netapp broadcom CWE-78
7.8
2019-01-31 CVE-2019-6111 Path Traversal vulnerability in multiple products
An issue was discovered in OpenSSH 7.9.
5.9
2019-01-31 CVE-2019-6110 Inappropriate Encoding for Output Context vulnerability in multiple products
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
network
high complexity
openbsd winscp netapp siemens CWE-838
6.8
2019-01-31 CVE-2019-6109 Improper Encoding or Escaping of Output vulnerability in multiple products
An issue was discovered in OpenSSH 7.9.
6.8