Scponly is a specialized file-transfer utility designed to provide restricted shell access for secure copy operations, serving a narrow but strategically sensitive use case in systems administration. The limited disclosed vulnerability signals associated with this product reflect either sparse coverage or difficulty in precise classification, underscoring the need to assess this component within the context of its deployment scope and authentication posture. Current severity, exploitation activity, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Scponly over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-1469HIGH scponly does not properly verify the path when finding the (1) scp or (2) sftp-server programs, which could allow remote authenticated users to bypass access controls by uploading | Apr 22, 2003 | 7.5 | 29 | NO | YES |
CVE-2004-1162HIGH The unison command in scponly before 4.0 does not properly restrict programs that can be run, which could allow remote authenticated users to bypass intended access restrictions an | Jan 10, 2005 | 7.5 | 24 | NO | NO |
CVE-2007-6350HIGH scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute code by invoking dangerous subcommands including (1) unison, (2) rsync, (3) sv | Dec 14, 2007 | 8.5 | 23 | NO | NO |
CVE-2005-4533HIGH Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via | Dec 28, 2005 | 7.5 | 19 | NO | NO |
CVE-2005-4532HIGH scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroo | Dec 28, 2005 | 7.2 | 18 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Scponly.
Media articles that mention a CVE ID that affects a product developed by Scponly — matched by CVE ID, not by vendor name.