CVE-2019-1000018

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

• CWE-77

• http://seclists.org/fulldisclosure/2021/May/78Mailing List, Not Applicable, Third Party Advisory
• https://esnet-security.github.io/vulnerabilities/20190115_rsshExploit, Third Party Advisory
• https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-33216%2CCVE-2019-1000018/CommScope%20Ruckus%20IoT%20Controller%201.7.1.0%20Undocumented%20Account.txt
• https://lists.debian.org/debian-lts-announce/2019/01/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
• https://security.gentoo.org/glsa/202007-29Third Party Advisory
• https://usn.ubuntu.com/3946-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4377Third Party Advisory
• http://seclists.org/fulldisclosure/2021/May/78Mailing List, Not Applicable, Third Party Advisory
• https://esnet-security.github.io/vulnerabilities/20190115_rsshExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/01/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
• https://security.gentoo.org/glsa/202007-29Third Party Advisory
• https://usn.ubuntu.com/3946-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4377Third Party Advisory

Published

Feb 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1000012Hex package manager version 0.14.0 through 0.18.2 contains a…
• CVE-2019-1000013Hex package manager hex_core version 0.3.0 and earlier conta…
• CVE-2019-1000014Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Sig…
• CVE-2019-1000015Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cr…
• CVE-2019-1000016FFMPEG version 4.1 contains a CWE-129: Improper Validation o…
• CVE-2019-1000017Chamilo Chamilo-lms version 1.11.8 and earlier contains an I…
• CVE-2019-1000019libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9…6.5
• CVE-2019-1000020libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb…6.5
• CVE-2019-1000021slixmpp version before commit 7cd73b594e8122dddf847953fcfc85…
• CVE-2019-1000022Taoensso Sente version Prior to version 1.14.0 contains a Cr…
• CVE-2019-1000023OPT/NET BV OPTOSS Next Gen Network Management System (NG-Net…
• CVE-2019-1000024OPT/NET BV NG-NetMS version v3.6-2 and earlier versions cont…