5
CVSSv2

CVE-2018-15919

Published: 28/08/2018 Updated: 07/03/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 5.3 | Impact Score: 1.4 | Exploitability Score: 3.9
VMScore: 447
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

Remotely observable behaviour in auth-gss2.c in OpenSSH up to and including 7.8 could be used by remote malicious users to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability.'

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openbsd openssh

netapp data ontap edge -

netapp ontap select deploy -

netapp steelstore -

netapp cloud backup -

netapp cn1610_firmware -

Vendor Advisories

Debian Bug report logs - #907503 openssh: CVE-2018-15919: user enumeration via auth2-gssc Package: src:openssh; Maintainer for src:openssh is Debian OpenSSH Maintainers <debian-ssh@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 28 Aug 2018 20:09:02 UTC Severity: normal Tags: secu ...
Remotely observable behaviour in auth-gss2c in OpenSSH through 78 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or "oracle") as a vulnerability' ...

Github Repositories

API for security awareness tool

Security Awareness API This is the API for an application to help users become more aware of the privacy implications of using the Internet The Internet makes life so much easier, but it also puts our privacy and safety at risk Client IP Information Every second, there are services running to gather information about every device connected to the Internet This means that the

CVE-2018-15473 成因 OpenSSH服务器在对包含了请求的数据包完全解析之前,不会延迟处理一个验证无效的用户。该漏洞和auth2-gssc,auth2-hostbasedc,auth2-pubkeyc有关。 利用 尽管该漏洞不能用来生成有效的用户名列表,但依旧可以拿来枚举猜测用户名。 受影响的版本 OpenSSH <= 77 不受影响的版

A raku-lang API client for Shodan.

NAME Shodan DESCRIPTION A raku-lang client for Shodan, a search engine for Internet-connected devices This client provides an interface for the Shodan API SYNOPSIS use Shodan; my $shodan = Shodannew(api-key => %*ENV{'SHODAN_API_KEY'}); my $api-info = $shodanapi-info(); my $host = $shodanhost(ip => '8888'); my $scan = $shodanscan(

ASN Lookup Tool and Traceroute Server

ASN Lookup Tool and Traceroute Server Container support: OS support: Table of contents: Description Screenshots Running the script from a container Installation Usage (as a command line tool) Usage (as a lookup & traceroute server) Usage (as a lookup API with JSON output) Description ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / ASPath / Orga

ASN Lookup Tool and Traceroute Server Quick jump: Description Screenshots Installation Usage (as a command line tool) Usage (as a lookup & traceroute server) Usage (as a lookup API with JSON output) Description ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup tool /

ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server

ASN Lookup Tool and Traceroute Server Container support: OS support: Table of contents: Description Screenshots Running the script from a container Installation Usage (as a command line tool) Usage (as a lookup & traceroute server) Usage (as a lookup API with JSON output) Description ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / ASPath / Orga

Security audit of DC-4 VulnHub

DC-4 VulnHub Configuration Step 1 : Download For this pentest audit we are going to use this instance : wwwvulnhubcom/entry/dc-4,313/ Step 2 : Virtualization product Unzip the file Use VMWare or VirtualBox to add the VM Step 3 : Virtual configuration Put the machine under the same subnet as your attack machine Step 4 : Start Start both VM Advise Never ex

Script that queries internetdb.shodan.io with random IP addresses. Intended use: data collection and research. Outputs in YAML. No API key needed.

RandScan Script that queries internetdbshodanio with random IP addresses Intended use: data collection and research Outputs in YAML No API key needed Just for fun and education; please no malicious use Usage /rand_scanpy ${iterations} where ${iterations} is the number of IP addresses to generate and query data on Example: $ /rand_scanpy 100 (14) wwwshodan