CVSS: 5.3EPSS: 90%CPEs: 32EXPL: 43CVE-2018-15473 – OpenSSH < 7.7 - User Enumeration
https://notcve.org/view.php?id=CVE-2018-15473
17 Aug 2018 — OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. OpenSSH hasta la versión 7.7 es propenso a una vulnerabilidad de enumeración de usuarios debido a que no retrasa el rescate de un usuario de autenticación no válido hasta que el paquete que contiene la petición haya sido analizado completamente. Esto e... • https://packetstorm.news/files/id/181223 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-14775
https://notcve.org/view.php?id=CVE-2018-14775
01 Aug 2018 — tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture. tss_alloc en sys/arch/i386/i386/gdt.c en OpenBSD 6.2 y 6.3 tiene una denegación de servicio (DoS) local (cierre inesperado del sistema) debido a un acceso incorrecto al puerto I/O en la arquitectura i386. • http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/i386/i386/gdt.c • CWE-20: Improper Input Validation •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2018-12434
https://notcve.org/view.php?id=CVE-2018-12434
15 Jun 2018 — LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. LibreSSL en versiones anteriores a la 2.6.5 y versiones 2.7.x anteriores a la 2.7.4 permite un ataque de canal lateral por caché de memoria en las firmas DSA y ECDSA. Esto también se conoce como Return Of the Hi... • https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.6.5-relnotes.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-8970
https://notcve.org/view.php?id=CVE-2018-8970
24 Mar 2018 — The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not. La función int_x509_param_set_hosts en li... • https://github.com/tiran/CVE-2018-8970 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 1%CPEs: 16EXPL: 0CVE-2016-10708 – openssh: Out of sequence NEWKEYS message can allow remote attacker to cause denial of service
https://notcve.org/view.php?id=CVE-2016-10708
21 Jan 2018 — sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. sshd en OpenSSH, en versiones anteriores a la 7.4, permite que atacantes remotos provoquen una denegación de servicio (desreferencia de puntero NULL y cierre inesperado del demonio) mediante un mensaje NEWKEYS fuera de secuencia, tal y como demuestra Honggfuzz, relacionado con kex.c y p... • http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 5.3EPSS: 2%CPEs: 28EXPL: 0CVE-2017-15906 – openssh: Improper write operations in readonly mode allow for zero-length file creation
https://notcve.org/view.php?id=CVE-2017-15906
26 Oct 2017 — The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. La función process_open en sftp-server.c en OpenSSH, en versiones anteriores a la 7.6, no evita correctamente las operaciones de escritura en el modo readonly, lo que permite que los atacantes creen archivos de longitud cero. Jann Horn discovered that OpenSSH incorrectly loaded PKCS#11 modules from untrusted directories. A remote a... • http://www.securityfocus.com/bid/101552 • CWE-20: Improper Input Validation CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 10%CPEs: 3EXPL: 1CVE-2015-7687
https://notcve.org/view.php?id=CVE-2015-7687
16 Oct 2017 — Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta. Uso de memoria previamente liberada en OpenSMTPD en versiones anteriores a la 5.7.2 permite que atacantes remotos provoquen una denegación de servicio (cierre inesperado) o que ejecuten código arbitrario mediante vectores relacionados con req_ca_vrfy_smtp y req_ca_vrfy_mta. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170448.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 16%CPEs: 1EXPL: 2CVE-2017-1000373 – OpenBSD - 'at Stack Clash' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-1000373
19 Jun 2017 — The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions. La función qsort() de OpenBSD es recursiva y no aleatorizada, por lo que un atacante puede construir un array de entrada pat... • https://packetstorm.news/files/id/143206 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 0CVE-2017-1000372 – Qualys Security Advisory - the Stack Clash
https://notcve.org/view.php?id=CVE-2017-1000372
19 Jun 2017 — A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. Existe un error en la implementación de OpenBSD de la página stack guard que permite que los atacantes la omitan, lo que resulta en la ejecución de código arbitrario mediante el uso de binarios setuid como /usr/bin/at. Esto afecta a OpenBSD 6.1 y posiblemente a versiones an... • http://www.securityfocus.com/bid/99172 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-8301
https://notcve.org/view.php?id=CVE-2017-8301
27 Apr 2017 — LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx. LibreSSL en las versiones 2.5.1 hasta la 2.5.3 carece de verificación de certificados TLS si se invoca SSL_get_verify_result para una comprobación posterior de un resultado de verificación, en un caso de uso en el que una devolución de ... • http://seclists.org/oss-sec/2017/q2/145 • CWE-295: Improper Certificate Validation •