CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43793 – Halo's editor has a stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-43793
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0. • https://github.com/halo-dev/halo/security/advisories/GHSA-28x9-hppj-m537 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43792 – Halo's editor has a stored Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2024-43792
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability. • https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27164
https://notcve.org/view.php?id=CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. • http://halo.com https://gist.github.com/b33t1e/a1a0d81b1173d0d00de8f4e7958dd867 https://github.com/halo-dev/halo https://notes.sjtu.edu.cn/s/s5oEvs-p5 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-22125 – Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
https://notcve.org/view.php?id=CVE-2022-22125
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en la etiqueta article. Un atacante autenticado puede inyectar código javascript arbitrario que será ejecutado en el servidor de la víctima • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L500 https://github.com/halo-dev/halo/issues/1557 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22125 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-22124 – Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
https://notcve.org/view.php?id=CVE-2022-22124
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en la imagen del perfil. Un atacante autenticado puede subir un archivo SVG cuidadosamente diseñado que desencadenará la ejecución de javascript arbitrario en el navegador de la víctima • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30 https://github.com/halo-dev/halo/issues/1575 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22124 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •