Rejetto
5 CVEs across 3 Rejetto products. Browse Rejetto vulnerabilities, severities, and proof-of-concept exploits.
Rejetto products with known CVEs
Rejetto CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-61505 | Medium | 5.3 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files… |
CVE-2026-61504 | Medium | 5.4 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basi… |
CVE-2026-61503 | Medium | 5.3 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote una… |
CVE-2026-61502 | Medium | 4.3 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attac… |
CVE-2026-61501 | Medium | 6.1 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a fa… |
CVE-2026-61500 | Critical | 9.8 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same gen… |
CVE-2024-39943 | Critical | 9.9 | 2024-07-04 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload pe… |
CVE-2024-23692 | Critical | 9.8 | 2024-05-31 | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenti… |
CVE-2024-1227 | Medium | 6.5 | 2024-03-12 | An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site. |
CVE-2024-1226 | High | 7.5 | 2024-03-12 | The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidat… |
CVE-2020-13432 | High | 7.5 | 2020-06-08 | rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access… |
CVE-2014-7226 | | | 2014-10-10 | The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain… |
CVE-2014-6287 | Critical | 9.8 | 2014-10-07 | The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbit… |