CVE-2010-4478
OpenSSH can be tricked into letting attackers in without knowing the password
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
OpenSSH versions before 5.7 could allow attackers to bypass login without the correct password if J-PAKE is enabled, potentially exposing sensitive data.