hfs-cve-2014-6287-exploit

HFS CVE-2014-6287 漏洞利用工具 概述 本仓库包含一个基于 Python 的漏洞利用工具，旨在利用 HTTP File Server HFS 版本 2.3.x 中的 CVE-2014-6287 漏洞。该漏洞允许攻击者在服务器上执行任意命令，可能导致未授权访问和控制。 ⚠️ 免责声明： 本工具仅用于教育目的和授权的渗透测试 。未经明确许可，针对您不拥有或无权测试的系统使用本工具是非法且不道德的。作者和贡献者不承担 因本工具被滥用或造成任何损害的责任。 目录 特点 前提条件 安装 使用 工作原理 配置 故障排除 贡献 作者 许可证 特点 命令执行： 在目标 HFS...

docker-log4shell

docker-log4shell 一个简单的 Go 应用 / Docker 镜像，用于测试 CVE-2021-44228 漏洞。它托管一个简单的文件服务器和一个 LDAP 服务器，该 LDAP 服务器提供文件服务器上托管的任何类：ldap://ip:1389/Hello - http://ip:8080/Hello.class docker build -t log4shell . docker run -it -v "path-to-classes:/files" -p 1389:1389 -p 8080:8080 -e HOST=localhost log4shell...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

CVE-2026-97362 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

CVE-2026-97362: Loop with Unreachable Exit Condition

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire fi...

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

Astra Linux – Vulnerability in liblivemedia

Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protection against send buffer overflow in NFSv2 READDIR. The previous limit on the @count argument has been restored to prevent buffer overflow attacks...

SUSE CVE-2026-62325

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

WindowsProtocolTestSuites v4.26.9.0

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

The vulnerability of the getDiskSpaceSync module, which is used to determine free disk space in the HTTP File Server 3 file server, allows a hacker to execute arbitrary commands.

The vulnerability of the getDiskSpaceSync function, which is responsible for determining free disk space on the HTTP File Server 3 file server, is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2026-45698 Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...

SUSE CVE-2026-52844

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but fileserver later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy...

CVE-2026-68100 ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

CVE-2026-67193 Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the...

CVE-2026-66063

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-66064

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...

CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...

PT-2026-65625

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file wi...

CVE-2026-28931

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. Connecting to a malicious NFS server may lead to kernel memory corruption...