DS
Product
Dropbear SSH
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 7Low 0
Watch
Add Dropbear SSH to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3116 | 6.4 | Mar 22 | CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data Affected: through 2015.71 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: before 2022.83 |
| CVE-2016-7409 | 5.5 | Mar 3 | The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote… Affected: through 2016.73 |
| CVE-2019-12953 | 5.3 | Dec 30 | Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599 Affected: 2011.54 through 2018.76 |
| CVE-2018-15599 | 5.3 | Aug 21 | The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in… Affected: through 2018.76 |
| CVE-2017-9079 | 4.7 | May 19 | Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option Affected: before 2017.75 |
| CVE-2025-47203 | 4.5 | May 7 | dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used Affected: before 2025.88 |
Showing 7