Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Rejetto HTTP File Server versions 3.0.0 through 3.2.0 derive their session-cookie signing key from JavaScript's non-cryptographic Math.random() generator and expose outputs of the same generator to unauthenticated clients during the SRP login handshake,...