CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43793 – Halo's editor has a stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-43793
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0. • https://github.com/halo-dev/halo/security/advisories/GHSA-28x9-hppj-m537 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43792 – Halo's editor has a stored Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2024-43792
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability. • https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27164
https://notcve.org/view.php?id=CVE-2023-27164
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. • http://halo.com https://gist.github.com/b33t1e/a1a0d81b1173d0d00de8f4e7958dd867 https://github.com/halo-dev/halo https://notes.sjtu.edu.cn/s/s5oEvs-p5 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32995
https://notcve.org/view.php?id=CVE-2022-32995
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function. Se ha detectado que Halo CMS versión v1.5.3, contiene una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) por medio de la función template remote download • https://github.com/zongdeiqianxing/cve-reports/issues/2 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-32994
https://notcve.org/view.php?id=CVE-2022-32994
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. Se ha detectado que Halo CMS versión v1.5.3, contiene una vulnerabilidad de carga de archivos arbitraria por medio del componente /api/admin/attachments/upload • https://github.com/zongdeiqianxing/cve-reports/issues/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •