https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:18:30 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-01880 bdu:2022-01880 https://cve.radiocsirt.org/vuln/bdu:2022-01880 https://cve.radiocsirt.org/vuln/bell-cve-2016-20012 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2016-20012 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/euvd-2026-322839 EUVD-2026-322839 https://cve.radiocsirt.org/vuln/euvd-2026-322839 https://cve.radiocsirt.org/vuln/fkie_cve-2016-20012 <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product</p> <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product</p> https://cve.radiocsirt.org/vuln/fkie_cve-2016-20012 https://cve.radiocsirt.org/vuln/ghsa-84j4-ccmw-hwpg <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.</p> <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.</p> https://cve.radiocsirt.org/vuln/ghsa-84j4-ccmw-hwpg https://cve.radiocsirt.org/vuln/gsd-2016-20012 gsd-2016-20012 https://cve.radiocsirt.org/vuln/gsd-2016-20012 https://cve.radiocsirt.org/vuln/msrc_cve-2016-20012 msrc_CVE-2016-20012 https://cve.radiocsirt.org/vuln/msrc_cve-2016-20012 https://cve.radiocsirt.org/vuln/sca-2025-0009 <p>The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances. An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source. In ISC DHCP 4.1-ESV-R…</p> <p>The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances. An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source. In ISC DHCP 4.1-ESV-R…</p> https://cve.radiocsirt.org/vuln/sca-2025-0009 https://cve.radiocsirt.org/vuln/ubuntu-cve-2016-20012 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: openssh, Ubuntu:Pro:16.04:LTS: openssh, Ubuntu:Pro:FIPS:16.04:LTS: openssh, Ubuntu:Pro:18.04:LTS: openssh, Ubuntu:18.04:LTS: openssh-ssh1, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssh, Ubuntu:Pro:FIPS:18.04:LTS: openssh, Ubuntu:Pro:20.04:LTS: openssh, Ubuntu:20.04:LTS: openssh-ssh1, Ubuntu:Pro:FIPS-updates:20.04:LTS: openssh and 3 more</p> <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: openssh, Ubuntu:Pro:16.04:LTS: openssh, Ubuntu:Pro:FIPS:16.04:LTS: openssh, Ubuntu:Pro:18.04:LTS: openssh, Ubuntu:18.04:LTS: openssh-ssh1, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssh, Ubuntu:Pro:FIPS:18.04:LTS: openssh, Ubuntu:Pro:20.04:LTS: openssh, Ubuntu:20.04:LTS: openssh-ssh1, Ubuntu:Pro:FIPS-updates:20.04:LTS: openssh and 3 more</p> <p>OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2016-20012 https://cve.radiocsirt.org/vuln/vde-2022-010 <p>PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.</p> <p>Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless.</p> <p>UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152</p> <p>PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.</p> <p>Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless.</p> <p>UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152</p> https://cve.radiocsirt.org/vuln/vde-2022-010 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0229 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSH ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0229