CVE-2019-6110Medium· 6.8▾ TwilightPoC availableIn OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
21%
21% → 25%
Exploit-DB (last check)
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.
openssh <= 7.9winscp <= 5.13element_softwareontap_select_deploystorage_automation_storescalance_x204rna_firmware < 3.2.7scalance_x204rna_eec_firmware < 3.2.7Upgrade past the affected range:
scalance_x204rna_firmware 3.2.7scalance_x204rna_eec_firmware 3.2.7Connected by shared product, vendor, weakness, or advisory.
CVE-2019-6111Medium· 5.9An issue was discovered in OpenSSH 7.9
CVE-2019-16905High· 7.8OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key
CVE-2019-6109Medium· 6.8An issue was discovered in OpenSSH 7.9
CVE-2023-38408Critical· 9.8The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system
CVE-2023-25136Medium· 6.5OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling
CVE-2020-15778High· 7.4scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument