Vendor
rejetto
12 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Medium 5.3
Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and forma…
-
Medium 5.4
Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload fol…
-
Medium 5.3
Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin accou…
-
Medium 4.3
Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading …
-
Medium 6.1
Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an ad…
-
Medium 6.5
Multiple vulnerabilities in Rejetto's Http File Server
An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site.