WI
Product
Winscp
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 6Low 0
Watch
Add Winscp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3331 | 9.8 | Jan 27 | WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings Affected: before 5.17.10 |
| CVE-2020-28864 | 9.8 | Nov 23 | Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file name Affected: 5.17.8 |
| CVE-2018-20684 | 7.5 | Jan 10 | In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files Affected: through 5.13.7 |
| CVE-2019-6110 | 6.8 | Jan 31 | In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for… Affected: through 5.13 |
| CVE-2019-6109 | 6.8 | Jan 31 | An issue was discovered in OpenSSH 7.9 Affected: through 5.13 |
| CVE-2024-31497 | 5.9 | Apr 15 | In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60… Affected: before 6.3.3 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: before 6.2.2 |
| CVE-2019-6111 | 5.9 | Jan 31 | An issue was discovered in OpenSSH 7.9 Affected: through 5.1.3 |
| CVE-2018-20685 | 5.3 | Jan 10 | In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of Affected: through 5.13 |
| CVE-2014-2735 | – | Apr 22 | WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the… Affected: through 5.5.2; 5.5; 5.5.1 |
| CVE-2013-4852 | – | Aug 19 | Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly… Affected: through 5.1.5; 3.7.6; 3.8.2; 3.8_beta; 4.0.4; 4.0.5; +27 more |
| CVE-2007-4909 | – | Sep 17 | Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote server via file-transfer commands in the final portion of… Affected: 2.0.0; 3.5.5_beta; 3.5.6; 3.6; 3.6.1; 3.6.5_beta; +6 more |
| CVE-2006-3015 | – | Jun 14 | Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or… Affected: 3.8.1 |
| CVE-2002-1357 | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service… Affected: 2.0.0 |
| CVE-2002-1360 | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote… Affected: 2.0.0 |
| CVE-2002-1359 | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary… Affected: 2.0.0 |
| CVE-2002-1358 | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute… Affected: 2.0.0 |
Showing 17