CVE-2008-0410

CVE-2008-0410 affects HFS (HTTP File Server) prior to 2.2c. The vulnerability enables information disclosure by placing an id element in the userinfo portion of a URL used for HTTP Basic Authentication (e.g., %version%). Remote attackers can obtain configuration and usage details from the server,...

CVE-2008-0405

CVE-2008-0405 affects HTTP File Server (HFS) and describes multiple directory traversal flaws in versions prior to 2.2c. When account names are used for log filenames, an attacker can trigger traversal with .. in the account name to create arbitrary files and directories via the / URI, and can ap...

CVE-2008-0405

Multiple directory traversal vulnerabilities in HTTP File Server HFS before 2.2c, when account names are used as log filenames, allow remote attackers to create arbitrary 1 files and 2 directories via a .. dot dot in an account name, when requesting the / URI; and 3 append arbitrary data to a fil...

CVE-2008-0407

CVE-2008-0407 affects HFS (HTTP File Server) up to version 2.2c. The vulnerability is a Username Spoofing issue where the server logs the username presented during HTTP Basic Authentication in request logs, even if authentication fails, which can mislead administrators about who actually made a r...

CVE-2008-0408

HTTP File Server HFS before 2.2c allows remote attackers to append arbitrary text to the log file by using the base64 representation of this text during HTTP Basic Authentication...

CVE-2008-0409

Cross-site scripting XSS vulnerability in HTTP File Server HFS before 2.2c allows remote attackers to inject arbitrary web script or HTML via the userinfo subcomponent of a URL...

CVE-2008-0406

HTTP File Server HFS before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service daemon crash via a long account name...

HFS HTTP File Server多个远程安全漏洞

BUGTRAQ ID: 27423 CVECAN ID: CVE-2008-0405,CVE-2008-0406,CVE-2008-0407,CVE-2008-0408,CVE-2008-0409,CVE-2008-0410 HTTP File Server是用于共享文件的开源HTTP服务器。 HFS没有正确地记录某些输入，用户可以在登陆时伪造用户名将任意内容注入到日志文件中。 HFS没有正确地过滤某些输入便将其返回给了用户，这可能导致在受影响服务器的用户浏览器会话中执行任意HTML和脚本代码。...

HFS HTTP File Server存在多个漏洞

HFS HTTP File Server是一款HTTP文件服务程序。 HFS HTTP File Server存在多个安全问题，远程攻击者可以利用漏洞进行跨站脚本，信息泄漏，拒绝服务，任意文件建立和用户名伪造等攻击。 1）使用"mkd"和"manipf"命令可导致任意文件和目录建立或操作： mkd ..\Syhunt manipf inject.html ..\Syhunt\index.html 2）发送特殊构建的请求，可导致服务程序崩溃。 3）不正确过滤用户的URI输入，可导致跨站脚本攻击：...

Syhunt: HFS (HTTP File Server) Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities

Syhunt: HFS HTTP File Server Log Arbitrary File/Directory Manipulation and Denial-of-Service Vulnerabilities Advisory-ID: 200801162 Discovery Date: 1.16.2008 Release Date: 1.23.2008 Affected Applications: HFS 2.2 to and including 2.3Beta Build 174 Non-Affected Applications: HFS 2.1d and earlier...

Syhunt: HFS (HTTP File Server) Template Cross-Site Scripting and Information Disclosure Vulnerabilities

Syhunt: HFS HTTP File Server Template Cross-Site Scripting and Information Disclosure Vulnerabilities Advisory-ID: 200801161 Discovery Date: 1.16.2008 Release Date: 1.23.2008 Affected Applications: HFS 2.0 to and including 2.3Beta Build 174 Non-Affected Applications: HFS 1.6a and earlier versions...

hfs-xss.txt

Syhunt: HFS HTTP File Server Template Cross-Site Scripting and Information Disclosure Vulnerabilities Advisory-ID: 200801161 Discovery Date: 1.16.2008 Release Date: 1.23.2008 Affected Applications: HFS 2.0 to and including 2.3Beta Build 174 Non-Affected Applications: HFS 1.6a and earlier versions...

Syhunt: HFS (HTTP File Server) Username Spoofing and Log Forging/Injection Vulnerability

Syhunt: HFS HTTP File Server Username Spoofing and Log Forging/Injection Vulnerability Advisory-ID: 200801163 Discovery Date: 1.16.2008 Release Date: 1.23.2008 Affected Applications: HFS 1.5g to and including 2.3Beta Build 174; and possibly HFS version 1.5f Non-Affected Applications: HFS 1.5e and...

Rejetto HTTP File Server (HFS) 1.52.x - Multiple Vulnerabilities

Rejetto HTTP File Server HFS 1.52.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/27423/info HFS HTTP File Server is prone to multiple security vulnerabilities, including cross-site scripting issues, an information-disclosure issue, an arbitrary file-creation issue, a...

Rejetto HTTP File Server (HFS) 1.5/2.x - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/27423/info HFS HTTP File Server is prone to multiple security vulnerabilities, including cross-site scripting issues, an information-disclosure issue, an arbitrary file-creation issue, a denial-of-service issue, a username-spoofing issue, and a...

HFS HTTP File Server任意文件上传漏洞

HTTP File Server是一款基于HTTP的文件服务程序。 HTTP File Server不正确过滤用户提交的文件数据，远程攻击者可以利用漏洞进行目录遍历攻击，上传文件到任意目标文件夹。 使用'../'形式的文件名形式，可绕过目录限制，上传文件到任意系统位置。 HTTP File Server HTTP File Server 2.2a HTTP File Server HTTP File Server 2.2 升级程序： HTTP File Server HTTP File Server 2.2a HTTP File Server HTTP File Server 2.2b...

HTTP File Server directory traversal

Durectory traversal on file upload...

Limited upload directory traversal in HTTP File Server 2.2a / 2.3 beta (build #146)

Luigi Auriemma Application: HTTP File Server http://www.rejetto.com/hfs/ Versions: = 2.2a and = 2.3 beta build 146 Platforms: Windows Bug: limited directory traversal in files uploading Exploitation: remote Date: 05 Dec 2007 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1...

Rejetto HTTP File Server (HFS) 2.22.3 - Arbitrary File Upload

Rejetto HTTP File Server HFS 2.22.3 - Arbitrary File Upload source: https://www.securityfocus.com/bid/26732/info HFS HTTP File Server is prone to a vulnerability that lets attackers upload files and place them in arbitrary locations on the server. The issue occurs because the software fails to...

Rejetto HTTP File Server (HFS) 2.2/2.3 - Arbitrary File Upload

source: https://www.securityfocus.com/bid/26732/info HFS HTTP File Server is prone to a vulnerability that lets attackers upload files and place them in arbitrary locations on the server. The issue occurs because the software fails to adequately sanitize user-supplied input. A successful exploit...