CVE-2026-88831

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. Mitigation Audit all BusyBox httpd configuration files for syntactically valid CIDR prefix lengths. Implement network-level access controls...

Popcorn-TJNULL-OSCP-

HackTheBox: Popcorn 渗透报告 日期： 2026年06月05日 难度： 简单 平台： HackTheBox 关键技术： 端口与服务枚举、目录模糊测试（Gobuster）、文件上传绕过、HTTP请求篡改（Burp Suite）、远程代码执行（RCE）、高级TTY Shell稳定化（Python）、本地内核/PAM漏洞利用（MOTD文件篡改）。 1. 侦察与枚举 端口扫描（快速侦察） 我们首先对所有65535个TCP端口进行一次快速扫描（-p-），以定位开放的入口点。我们使用 --min-rate 5000...

CVE-2021-4773

CVE-2021-4773 这是如何利用虚拟机中的CVE-2021-4773漏洞的练习示例 本教程需要以下内容 kali Linux虚拟机 Ubuntu Server虚拟机 安装Apache 2.4.49版本 那么让我们开始 当你有2个虚拟机在运行时，你需要通过归档仓库安装Apache 2.4.49版本 你可以在这里找到该版本： https://archive.apache.org/dist/httpd/CHANGES2.4.49 在Ubuntu Server中安装并配置存在漏洞的版本 1 第一次在你的服务器虚拟机上，需要运行以下命令 curl -k -L -s --compressed...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88831: Not Failing Securely

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.

Summary The kernel, glibc, expat, RMC daemon, httpd and modhttp2 libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash d...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090049)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090049 advisory. HTTP/2 2.4.20 through 2.4.39 very early pushes, for example configured with H2PushResource, could lead to an overwrite of memory in the pushing request's pool, leadi...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003826 advisory. If LimitXMLRequestBody is set to allow request bodies larger than 350MB defaults to 1M on 32 bit systems an integer overflow happens which later causes out of bounds...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003827)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003827 advisory. Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-000273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000273 advisory. Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090073 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE Tenable has extracted the preceding description block directly from the Unity Linu...

CVE-2026-66835

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-3869)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : locking/rtmutex: Skip removewaiter when waiter is not enqueuedCVE-2026-53163 ppp: require CAPNETADMIN in target netns for unattached...

EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2026-3589)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.This issue affects Apache HTTP Server: through...

EulerOS Virtualization 2.11.0 : httpd (EulerOS-SA-2026-3509)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

The vulnerability of the fromGstDhcpSetSer() function (/goform/GstDhcpSetSer) in the httpd microprogramming system for Tenda F451 components allows a attacker to cause a service failure.

The vulnerability of the fromGstDhcpSetSer function /goform/GstDhcpSetSer in the httpd microprogramming system for Tenda F451 components is related to the issue of the operation going beyond the buffer in memory when processing the dips parameter. Exploiting this vulnerability could allow an...

EulerOS Virtualization 2.11.1 : httpd (EulerOS-SA-2026-3422)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

CVE-2026-70399

A flaw was found in inets. An unauthenticated remote attacker can exploit a resource allocation vulnerability in the Erlang/OTP inets httpd component. This flaw allows the attacker to cause a denial of service by opening and holding open a large number of connections. The server fails to enforce...

EulerOS 2.0 SP15 : httpd (EulerOS-SA-2026-3806)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A buffer overflow in modproxyhtml in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend.x000D Users are recommended to...

Astra Linux – Vulnerability in Subversion

Apache Subversion SVN’s “authz” feature prevents the display of “copyfrom” paths that should be hidden according to configured path-based authorization rules. When a node is copied from a protected location, users with access to the copy can see the “copyfrom” path of the original node. This also...