Ssh2

Vendor:

First CVE: Dec 29, 1998 · Active for 27 years

9

Total CVEs

More Total CVEs than 86% of tracked products

1.8

Avg CVEs / Year

Higher CVE frequency than 60% of tracked products

6.2

Avg CVSS

Higher Avg CVSS than 25% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Ssh2 over time

Volume of CVEsAvg CVSS Base Score

First CVE

Dec 29, 1998

27 years ago

Most Recent CVE

Dec 31, 2002

8,606 days ago

CVE Severity & Scoring

Ssh29 CVEs

56%

44%

All CVEs352,231 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local0 (0.0%)

Network0 (0.0%)

Unknown9 (100.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low0 (0.0%)

High0 (0.0%)

Unknown9 (100.0%)

User Interaction

None0 (0.0%)

Unknown9 (100.0%)

Required0 (0.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None0 (0.0%)

Unknown9 (100.0%)

Top CVEs

Signals from CVEs in this product scope (9 CVEs).

9 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2002-1645HIGH Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstations client 3.1 to 3.2.0 allows remote attackers to execute arbitrary code via a long URL.	Nov 25, 2002	10.0	33	NO	NO
CVE-2002-1715HIGH SSH 1 through 3, and possibly other versions, allows local users to bypass restricted shells such as rbash or rksh by uploading a script to a world-writeable directory, then execut	Dec 31, 2002	7.2	27	NO	YES
CVE-2001-0364MEDIUM SSH Communications Security sshd 2.4 for Windows allows remote attackers to create a denial of service via a large number of simultaneous connections.	Jun 27, 2001	5.0	19	NO	NO
CVE-1999-1029HIGH SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the pas	May 13, 1999	7.5	19	NO	NO
CVE-2002-1644HIGH SSH Secure Shell for Servers and SSH Secure Shell for Workstations 2.0.13 through 3.2.1, when running without a PTY, does not call setsid to remove the child process from the proce	Nov 25, 2002	7.2	18	NO	NO
CVE-2000-0217MEDIUM The default configuration of SSH allows X forwarding, which could allow a remote attacker to control a client's X sessions via a malicious xauth program.	Feb 24, 2000	5.1	15	NO	NO
CVE-1999-1231MEDIUM ssh 2.0.12, and possibly other versions, allows valid user names to attempt to enter the correct password multiple times, but only prompts an invalid user name for a password once,	Jun 9, 1999	5.0	15	NO	NO
CVE-1999-0398MEDIUM In some instances of SSH 1.2.27 and 2.0.11 on Linux systems, SSH will allow users with expired accounts to login.	Jan 1, 1999	4.6	14	NO	NO
CVE-1999-1159MEDIUM SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root.	Dec 29, 1998	4.6	14	NO	NO

View all 9 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (9 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

11.1% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (9 CVEs).

Media Mentions

Signals from CVEs in this product scope (9 CVEs).

Top CNAs Publishing CVEs For Ssh2

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
3.2.1	1	7.2	0.4%	0
3.2	2	8.6	4.2%	0
3.1.4	2	8.6	4.2%	0
3.1.3	2	8.6	4.2%	0
3.1.2	2	8.6	4.2%	0
3.1.1	2	8.6	4.2%	0
3.1	2	8.6	4.2%	0
3.0.1	1	7.2	0.4%	0
3.0	2	7.2	0.7%	1
2.5	2	7.2	0.7%	1
2.4	3	6.5	1.0%	1
2.3	2	7.2	0.7%	1
2.2	2	7.2	0.7%	1
2.1	2	7.2	0.7%	1
2.0.9	4	6.2	1.2%	1
2.0.8	4	6.2	1.2%	1
2.0.7	4	6.2	1.2%	1
2.0.6	4	6.2	1.2%	1
2.0.5	4	6.2	1.2%	1
2.0.4	4	6.2	1.2%	1