CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Putty » Putty » 0.49 : Security Vulnerabilities

Cpe Name:cpe:/a:putty:putty:0.49
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-17069 20 DoS 2019-10-01 2019-10-08
5.0
None Remote Low Not required None None Partial
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
2 CVE-2019-17068 74 2019-10-01 2019-10-08
5.0
None Remote Low Not required None Partial None
PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content.
3 CVE-2019-17067 770 2019-10-01 2019-10-08
7.5
None Remote Low Not required Partial Partial Partial
PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection.
4 CVE-2019-9898 327 2019-03-21 2019-04-26
7.5
None Remote Low Not required Partial Partial Partial
Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71.
5 CVE-2019-9897 20 2019-03-21 2019-04-26
5.0
None Remote Low Not required None None Partial
Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71.
6 CVE-2019-9896 20 2019-03-21 2019-04-04
4.6
None Local Low Not required Partial Partial Partial
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
7 CVE-2019-9895 119 Overflow 2019-03-21 2019-04-05
7.5
None Remote Low Not required Partial Partial Partial
In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.
8 CVE-2019-9894 320 2019-03-21 2019-04-26
6.4
None Remote Low Not required None Partial Partial
A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
9 CVE-2004-1440 DoS Exec Code Overflow 2004-12-31 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an SSH2 packet with a base argument that is larger than the mod argument, which causes the modpow function to write memory before the beginning of its buffer, and (2) remote malicious servers to cause a denial of service (client crash) and possibly execute arbitrary code via a large bignum during authentication.
10 CVE-2004-1008 Exec Code Overflow 2005-01-10 2017-07-10
10.0
Admin Remote Low Not required Complete Complete Complete
Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.
11 CVE-2003-0048 2003-02-19 2016-10-17
4.6
User Local Low Not required Partial Partial Partial
PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials.
12 CVE-2002-1360 20 DoS Exec Code 2002-12-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote attackers to cause a denial of service or possibly execute arbitrary code due to interactions with the use of null-terminated strings as implemented using languages such as C, as demonstrated by the SSHredder SSH protocol test suite.
13 CVE-2002-1359 20 DoS Exec Code Overflow 2002-12-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code via buffer overflow attacks, as demonstrated by the SSHredder SSH protocol test suite.
14 CVE-2002-1358 20 DoS Exec Code 2002-12-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
15 CVE-2002-1357 119 DoS Exec Code Overflow 2002-12-23 2017-10-10
10.0
Admin Remote Low Not required Complete Complete Complete
Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service or possibly execute arbitrary code, as demonstrated by the SSHredder SSH protocol test suite.
Total number of vulnerabilities : 15   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.