251 matches found
goshs
你正处于渗透测试的中期阶段。你需要传输文件、捕获 SMB 哈希，或快速搭建一个 HTTPS 服务器——而 python3 -m http.server 根本不够用。 goshs 是一个单二进制文件服务器，专为那些你需要比 Python 的 SimpleHTTPServer 更强大、但又不想配置 Apache 的场景而设计。HTTP/S、WebDAV、FTP/SFTP、SMB、LDAP/S、基本认证、分享链接、DNS/SMTP 回调、NTLM 哈希捕获与破解——全部通过一条命令完成。 !goshs-screenshot-darkhttps://raw.gith...
CVE-2025-46816
CVE-2025-46816 针对 goshs 版本 1.0.5 代码执行漏洞的POC...
SUSE CVE-2026-62325
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...
CVE-2026-50138
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50139
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50139
goshs (a SimpleHTTPServer written in Go, package goshs.de/goshs/v2) is affected by a race condition in ShareHandler prior to version 2.1.0. The handler reads a share token's DownloadLimit under a read lock, releases the lock, serves the file, and only then re-acquires a write lock to increment th...
EUVD-2026-60950
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50139
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50139 goshs: Share-link ?token=… redemption races past download limit
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138
goshs is a SimpleHTTPServer written in Go. Prior to v2.1.0 , when WebDAV is enabled (-w), the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired directly to golang.org/x/net/webdav.Handler with no equivalent guar...
EUVD-2026-60948
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
GO-2026-6133 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx in github.com/patrickhener/goshs...
GO-2026-6137 goshs has a Path Traversal issue in github.com/patrickhener/goshs
goshs has a Path Traversal issue in github.com/patrickhener/goshs...
GO-2026-6132 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs
goshs SFTP authentication bypass via empty password incomplete fix of CVE-2026-40884 in goshs.de/goshs...