PU
Vendor
Putty
36
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-48852 | PU PuTTY PuTTY | 3.7 | May 25 | PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification |
| CVE-2026-48851 | PU PuTTY PuTTY | 3.1 | May 25 | PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session |
| CVE-2026-48850 | PU PuTTY PuTTY | 5.9 | May 25 | PuTTY 0.72 before 0.84 has a double free in RSA KEX |
| CVE-2026-4115 | PU PuTTY Putty | 3.7 | Mar 22 | PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification |
| CVE-2024-31497 | PU Putty Putty | 5.9 | Apr 15 | In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60… |
| CVE-2023-48795 | PU Putty Putty | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… |
| CVE-2021-36367 | PU Putty Putty | 8.1 | Jul 9 | PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response |
| CVE-2021-33500 | PU Putty Putty | 7.5 | May 21 | PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its title repeatedly at high speed, which… |
| CVE-2020-14002 | PU Putty Putty | 5.9 | Jun 29 | PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation |
| CVE-2019-17069 | PU Putty Putty | 7.5 | Oct 1 | PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message |
| CVE-2019-17068 | PU Putty Putty | 7.5 | Oct 1 | PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content |
| CVE-2019-17067 | PU Putty Putty | 9.8 | Oct 1 | PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connection |
| CVE-2019-9898 | PU Putty Putty | 9.8 | Mar 21 | Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71 |
| CVE-2019-9897 | PU Putty Putty | 7.5 | Mar 21 | Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71 |
| CVE-2019-9896 | PU Putty Putty | 7.8 | Mar 21 | In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable |
| CVE-2019-9895 | PU Putty Putty | 9.8 | Mar 21 | In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding |
| CVE-2019-9894 | PU Putty Putty | 7.5 | Mar 21 | A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification |
| CVE-2017-6542 | PU Putty Putty | 9.8 | Mar 27 | The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging… |
| CVE-2016-6167 | PU Putty Putty | 7.8 | Jan 30 | Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll… |
| CVE-2015-2157 | PU Putty Putty | – | Mar 27 | The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain… |
| CVE-2011-4607 | PU Putty Putty | – | Aug 23 | PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to… |
| CVE-2013-4852 | PU Putty Putty | – | Aug 19 | Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly… |
| CVE-2013-4208 | PU Putty Putty | – | Aug 19 | The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory,… |
| CVE-2013-4207 | PU Putty Putty | – | Aug 19 | Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during… |
| CVE-2013-4206 | PU Putty Putty | – | Aug 19 | Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) and possibly trigger memory… |
| CVE-2006-7162 | PU Putty Putty | – | Mar 7 | PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users… |
| CVE-2005-0467 | PU Putty Putty | – | Feb 21 | Multiple integer overflows in the (1) sftp_pkt_getstring and (2) fxp_readdir_recv functions in the PSFTP and PSCP clients for PuTTY 0.56, and possibly earlier versions, allow… |
| CVE-2004-1008 | PU Putty Putty | – | Jan 10 | Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen… |
| CVE-2004-1440 | PU Putty Putty | – | Dec 31 | Multiple heap-based buffer overflows in the modpow function in PuTTY before 0.55 allow (1) remote attackers to execute arbitrary code via an SSH2 packet with a base argument that… |
| CVE-2003-0069 | PU Putty Putty | – | Mar 18 | The PuTTY terminal emulator 0.53 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's… |
| CVE-2003-0048 | PU Putty Putty | – | Feb 19 | PuTTY 0.53b and earlier does not clear logon credentials from memory, including plaintext passwords, which could allow attackers with access to memory to steal the SSH credentials |
| CVE-2002-1357 | PU Putty Putty | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle packets or data elements with incorrect length specifiers, which may allow remote attackers to cause a denial of service… |
| CVE-2002-1360 | PU Putty Putty | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle strings with null characters in them when the string length is specified by a length field, which could allow remote… |
| CVE-2002-1359 | PU Putty Putty | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers to cause a denial of service or possibly execute arbitrary… |
| CVE-2002-1358 | PU Putty Putty | – | Dec 23 | Multiple SSH2 servers and clients do not properly handle lists with empty elements or strings, which may allow remote attackers to cause a denial of service or possibly execute… |
| CVE-2000-0476 | PU Putty Putty | – | Jun 1 | xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized |