Fedora 40 : glycin-loaders / gnome-tour / helix / helvum / libipuz / loupe / etc (2024-ce2936b568)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ce2936b568 advisory. This update contains builds from a mini-mass-rebuild for Rust applications and some C-style libraries. Rebuilding with the Rust 1.78 toolchain should fix...

HashBrown CMS RCE

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

GHSA-4GJV-5JJP-RCGH HashBrown CMS RCE

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

GHSA-Q7HX-MRV5-6MRP HashBrown CMS Directory Traversal

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

HashBrown CMS Directory Traversal

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

HashBrown CMS 'postUser' function boost vulnerability

HashBrown CMS is an open source headless content management system CMS. A power lifting vulnerability exists in the 'postUser' function in HashBrown CMS version 1.3.3 and earlier. An attacker can exploit this vulnerability to change the hashed password of an administrator account or reset the...

HashBrown CMS Remote Code Execution Vulnerability

HashBrown CMS is an open source headless content management system CMS. HashBrown CMS suffers from a remote code execution vulnerability that stems from the program not performing proper security checks. An attacker could exploit the vulnerability to execute code...

CVE-2020-6948

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6948

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

Privilege escalation

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

Remote code execution

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6948

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6948

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6948

Summary (CVE-2020-6948): HashBrown CMS up to version 1.3.3 contains a remote code execution flaw in the deployer code path. Specifically, Server/Entity/Deployer/GitDeployer.js uses Service.AppService.exec in a way that mishandles URL, repository, username, and password. The vulnerability is docum...

CVE-2020-6948

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6949

HashBrown CMS up to version 1.3.3 contains a privilege-escalation flaw in the postUser function. An editor user can modify the password hash of an admin account or reconfigure that account, enabling lateral/admin access. The vulnerability is described across multiple sources (HashBrown CMS ecosys...