Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287

Dieses Repository hat keine README-Datei...

CVE-2024-23692

Vulnerabilità CVE-2024-23692 di Rejetto HFS HTTP File Server Panoramica Rejetto HFS HTTP File Server è un semplice server web per la condivisione di file che facilita la condivisione di file su una rete o su Internet. Nonostante la sua facilità d'uso e semplicità, è stata scoperta una vulnerabili...

rejjeto_hfs-rce-exploit-cve-2014-6287

HFS Exploit für Remote-Befehlsausführung CVE-2014-6287 Dies ist eine Python-3-Neuimplementierung des klassischen Remote-Befehlsausführungs-Exploits RCE, der den Rejetto HTTP File Server HFS v2.3.x anvisiert und die als CVE-2014-6287 identifizierte Sicherheitslücke ausnutzt. Ursprünglich entdeckt...

CVE-2024-39943-Poc

CVE-2024-39943-Poc CVE-2024-39943 rejetto HFS noto anche come HTTP File Server 3 precedente alla 0.52.10 su Linux, UNIX e macOS consente l'esecuzione di comandi OS da parte di utenti remoti autenticati se dispongono dei permessi di Upload. Ciò accade perché una shell viene utilizzata per eseguire...

CVE-2024-23692-RCE-in-Rejetto-HFS

Falha de RCE Não Autenticada no Rejetto HTTP File Server CVE-2024-23692 - código de exploração CVE-2024-23692 é uma vulnerabilidade crítica no Rejetto HTTP File Server HFS versão 2.3m, permitindo execução remota de código RCE não autenticada. Esta falha permite que atacantes executem código...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 Ein Write-up zur Steel Mountain Box von TryHackMe.com und Exploit für CVE-2014-6287 Credits Ich maße mir nicht an, die ursprüngliche Entdeckung und Ausnutzung dieser Schwachstelle selbst gemacht zu haben. Vielen Dank an die folgenden Personen! Entdeckung: Daniele...

CVE-2024-23692

POC - Vulnerabilità RCE non autenticata in Rejetto HTTP File Server - CVE-2024-23692 Panoramica POC - Vulnerabilità RCE non autenticata in Rejetto HTTP File Server - CVE-2024-23692 CVE-2024-23692 - YouTube CVE-2024-23692 è una vulnerabilità critica in Rejetto HTTP File Server HFS versione 2.3m, c...

CVE-2024-23692

Rejetto HTTP File Server HFS - Riproduzione della vulnerabilità RCE non autenticata CVE-2024-23692 Introduzione Rejetto HTTP File Server HFS è un server HTTP leggero per la condivisione e il trasferimento di file. La vulnerabilità CVE-2024-23692 è una vulnerabilità di injection di template che...

Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution

Rejetto HTTP File Server HFS 2.3.x - Esecuzione remota di comandi CVE-2014-6287 Riscrittura di Pergyz 49584.py per restituire una Reverse Shell PowerShell x64 Utilizzo $ python3 hfs-2-3-exploit.py Fornisci le variabili quando richiesto, avvia automaticamente Netcat per te...

Rejetto-HFS-2.x-RCE-CVE-2024-23692

Um SSTI não autenticado no Rejetto HTTP File Server HFS. PoC do descobridor original: https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ Testado nas versões: 2.4.0 RC7, 2.3m Exemplo de uso: root@kitploit: msf6 use exploit/windows/http/rejettohfsrcecve202423692 No payload...

CVE-2014-6287

CVE-2014-6287 - Rejetto HTTP File Server RCE-Exploit Eine Rust-Implementierung des Exploits für CVE-2014-6287, der gegen Rejetto HTTP File Server HFS Versionen 2.3x vor 2.3c gerichtet ist. Überblick über die Schwachstelle CVE-2014-6287 ist eine kritische Schwachstelle zur Remote-Codeausführung im...

CVE-2024-23692

CVE-2024-23692 - Rejetto HFS Remote Code Execution RCE Eine taktische Dokumentation und ein Exploit-Leitfaden für CVE-2024-23692 , eine kritische, ohne Authentifizierung ausnutzbare Schwachstelle für Remote Code Execution RCE, die Rejetto HTTP File Server HFS in Versionen vor 2.3m betrifft. Diese...

CVE-2026-61505

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

CVE-2026-61504

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name...

CVE-2026-61503

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and...

CVE-2026-61502

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a...

CVE-2026-61500

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's...

CVE-2026-61505

Vulnerability summary: Rejetto HFS versions 3.0.0–3.2.0 are affected by a path traversal via the lang parameter, allowing a remote, unauthenticated attacker to read certain JSON files outside shared folders. The impact is constrained to files matching a narrow naming/format pattern, with no indic...

CVE-2026-61505 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

CVE-2026-61505 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...