CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6948: Improper Neutralization of Special Elements used in an OS Command

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

CVE-2020-6949: Improper Privilege Management

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

PT-2020-19301

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions 1.3.3 and earlier Description A remote code execution issue was discovered. The Server/Entity/Deployer/GitDeployer.js file has a Service.AppService.exec call that mishandles the URL, repository, username, and password...

PT-2020-19302

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions through 1.3.3 Description A privilege escalation issue was found in the postUser function. This allows an editor user to change the password hash of an admin user's account or reconfigure the account. Recommendations For...

Unspecified Vulnerability in HashBrown CMS

HashBrown CMS is an open source headless content management system CMS. A security vulnerability exists in the Server/Entity/Resource/Connection.js file in HashBrown CMS versions prior to 1.3.2. The vulnerability can be exploited by an attacker to access the parent directory with the help of a...

CVE-2020-5840

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

CVE-2020-5840

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

Code injection

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

CVE-2020-5840

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

CVE-2020-5840

Summary: HashBrown CMS prior to 1.3.2 contains a directory traversal vulnerability in Server/Entity/Resource/Connection.js that allows an attacker to reach a parent directory by supplying a crafted name or ID. Impact (as documented): potential access to parent directories, enabling unauthorized n...

CVE-2020-5840

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

CVE-2020-5840

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...

CVE-2020-5840: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in HashBrown CMS before 1.3.2. Server/Entity/Resource/Connection.js allows an attacker to reach a parent directory via a crafted name or ID field...