CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 2CVE-2019-16905 – Gentoo Linux Security Advisory 201911-01
https://notcve.org/view.php?id=CVE-2019-16905
09 Oct 2019 — OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. OpenSSH 7.7 a 7.9 y 8.x anterior de la v... • https://0day.life/exploits/0day-1009.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.3EPSS: 12%CPEs: 8EXPL: 5CVE-2003-0190 – OpenSSH/PAM 3.6.1p1 - 'gossh.sh' Remote Users Ident
https://notcve.org/view.php?id=CVE-2003-0190
02 May 2003 — OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. OpenSSH-portable (OpenSSH) 3.6.1p1 y anteriores con soporte PAM activado envía inmediatamente un mensaje de error cuando un usuario no existe, lo que permite a atacantes remotos determinar nombres de usuario válidos mediante un ataque de temporización. • https://packetstorm.news/files/id/181223 • CWE-203: Observable Discrepancy •