Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
80 results · page 1 of 2
Oct 26, 2026A flaw has been found in halo-dev halo up to 2.27.0-beta.1.CVE-2026-116117 · Other software · halo-dev · reported by VulDBMedium 5.5
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1.CVE-2026-97182 · Other software · halo-dev · reported by VulDBMedium 5.5
A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Sep 14, 2026Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter.CVE-2026-91772 · Other software · halo-dev · reported by VulnCheckMedium 5.3
Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of redirect-based trust relationships.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo proceCVE-2026-78971 · Other software · reported by MITREMedium 4.6
In Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components.CVE-2026-67921 · Other software · reported by MITRECritical 9.3
Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 18, 2026An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.spCVE-2026-67920 · Other software · reported by MITREHigh 8.8
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 17, 2026An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationConteCVE-2026-67919 · Other software · reported by MITRECritical 9.8
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 18, 2026A vulnerability was detected in halo-dev halo up to 2.24.2.CVE-2026-16088 · Other software · halo-dev · reported by VulDBLow 2
A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026A vulnerability was identified in halo-dev halo up to 2.24.2.CVE-2026-15326 · Other software · halo-dev · reported by VulDBLow 2
A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. Such manipulation of the argument metadata.name leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project closed the issue as "duplicate" but did not reference any other issue, report, or CVE.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Halo is an open source website building tool.CVE-2026-55439 · Other software · halo-dev · reported by GitHubMedium 5.5
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint (GET /apis/console.api.migration.halo.run/v1alpha1/backups/{name}/files/{filename}) in MigrationServiceImpl.download() resolves the backup filename via Path.resolve() without validating that the resolved path stays within the designated backups directory. Also, the Backup creation endpoint (POST /apis/migration.halo.run/v1alpha1/backups) does not sanitize the status fields during creation This vulnerability is fixed in 2.24.3.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unaCVE-2026-7763 · Other software · Morse Micro · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Critical 9.8
A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. The function morse_page_slicing_process_tim_element() in page_slicing.c derives the TIM bitmap length directly from a received IE field without validating it against the fixed-size destination buffer before passing it to memset and memcpy operations, allowing up to 252 bytes of attacker-controlled data to be written beyond the buffer boundary. Because beacons are broadcast frames processed during passive scanning, no authentication, association, or user interaction is required.
- Product
- HaLowLink 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2026A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an uCVE-2026-7762 · Other software · Morse Micro · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Critical 9.8
A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information Element (IE element ID 0xD9). The function morse_dot11ah_find_s1g_caps_for_bssid() uses the IE length field directly as the size argument to memcpy without validating it against the 15-byte destination buffer. An attacker can supply up to 255 bytes, causing an overflow of up to 240 bytes of attacker-controlled data into adjacent kernel heap memory. The vulnerability is triggerable during normal scanning without authentication, association, or user interaction.
- Product
- HaLowLink 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2026An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthentiCVE-2026-7764 · Other software · Morse Micro · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Medium 6.8
An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.12 allows an unauthenticated attacker within radio range to disclose a small amount of kernel heap memory or cause a Denial of Service (kernel oops/panic) via a crafted 802.11ah beacon or probe response frame containing a malformed Vendor Information Element. The function morse_vendor_find_vendor_ie() does not validate the IE length against the expected structure size before its result is passed to morse_vendor_rx_caps_ops_ie() and morse_vendor_fill_sta_vendor_info(), which read at fixed offsets into the IE data. Because the length check only requires the IE to be longer than 3 bytes, an attacker can supply an undersized IE, causing a heap out-of-bounds read of up to 9 bytes. No authentication, association, or user interaction is required.
- Product
- HaLowLink 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resourcesCVE-2026-36757 · Other software · reported by MITREMedium 4.3
A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources CVE-2026-36759 · Other software · reported by MITREMedium 6.5
A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via aCVE-2026-36758 · Other software · reported by MITREMedium 4.3
A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via CVE-2026-36756 · Other software · reported by MITREMedium 5.4
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpointCVE-2025-70886 · Other software · Halo · reported by MITREHigh 7.5
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was determined in Halo up to 2.21.10.CVE-2025-15141 · Other software · Halo · reported by VulDBLow 1.3
A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2025A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b.CVE-2025-14695 · Other software · SamuNatsu · reported by VulDBLow 2.1
A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/html_renderer/index.js of the component Inter-plugin API. Executing manipulation of the argument action can lead to dynamically-managed code resources. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- HaloBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2025A vulnerability has been found in fit2cloud Halo 2.21.10.CVE-2025-14117 · Other software · fit2cloud · reported by VulDBLow 2.1
A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblksword.flowus.cngithub.com
Oct 29, 2025An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the serCVE-2025-60898 · Other software · reported by MITREMedium 5.8
An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a user-supplied URI without adequate allow/blocklist validation and returns a 307 redirect that can disclose internal URLs in the Location header.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.CVE-2025-44595 · Other software · Halo · reported by MITREMedium 6.1
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmeadow-horn-b94.notion.site
Sep 9, 2025Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files.CVE-2025-44593 · Other software · Halo · reported by MITREMedium 6.1
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmeadow-horn-b94.notion.site
Sep 9, 2025halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.CVE-2025-44594 · Other software · Halo · reported by MITRECritical 9.1
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmeadow-horn-b94.notion.site
Aug 5, 2025The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.CVE-2025-51857 · Other software · reported by MITREMedium 6.1
The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 8, 2025Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to maliciousCVE-2025-40846 · Other software · HaloITSM · reported by vulnerability@ncsc.chHigh 7.1
Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to malicious websites (Open Redirect) and inject JavaScript code to perform cross site scripting attack. The vulnerability affects Halo versions up to 2.174.101 and all versions between 2.175.1 and 2.184.21
- Product
- ITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.haloservicedesk.com
Apr 25, 2025Halo is an open source website building tool.CVE-2024-56156 · Other software · halo-dev · reported by GitHubMedium 5.5
Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices.CVE-2024-23963 · Other software · Alpine · reported by ics-cert@hq.dhs.govHigh 8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the PBAP_DecodeVCARD function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices.CVE-2024-23962 · Other software · Alpine · reported by ics-cert@hq.dhs.govMedium 5.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLT interface, which listens on TCP port 3490 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device.
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-45252 · Other software · Elsight · reported by cna@cyber.gov.ilCritical 9.8
Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Product
- Halo version 11.7.1.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2024Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-45251 · Other software · Elsight · reported by cna@cyber.gov.ilCritical 9.8
Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Product
- Halo version 11.7.1.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability.CVE-2024-23961 · Other software · Alpine · reported by cve@asrg.ioMedium 6.8
Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDM_wemCmdUpdFSpeDecomp function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23306
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability.CVE-2024-23960 · Other software · Alpine · reported by cve@asrg.ioMedium 4.6
Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validation mechanism on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware metadata signature validation mechanism. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23102
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2024-23935 · Other software · Alpine · reported by cve@asrg.ioHigh 8
Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the DecodeUTF7 function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23249
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability.CVE-2024-23924 · Other software · Alpine · reported by cve@asrg.ioMedium 6.8
Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDM_wemCmdCreatSHA256Hash function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23105
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2024Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability.CVE-2024-23923 · Other software · Alpine · reported by cve@asrg.ioHigh 8.8
Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prh_l2_sar_data_ind function. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22945
- Product
- Halo9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024Halo is an open source website building tool.CVE-2024-43793 · Other software · halo-dev · reported by GitHubMedium 6.3
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2024Halo is an open source website building tool.CVE-2024-43792 · Other software · halo-dev · reported by GitHubMedium 6.3
Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.
- Product
- halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability.CVE-2024-6203 · Other software · Halo Service Solutions · reported by vulnerability@ncsc.chHigh 8.3
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
- Product
- HaloITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability.CVE-2024-6202 · Other software · Halo Service Solutions · reported by vulnerability@ncsc.chCritical 9.8
HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
- Product
- HaloITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails.CVE-2024-6201 · Other software · Halo Service Solutions · reported by vulnerability@ncsc.chMedium 5.3
HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
- Product
- HaloITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability.CVE-2024-6200 · Other software · Halo Service Solutions · reported by vulnerability@ncsc.chHigh 8
HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
- Product
- HaloITSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).CVE-2023-33528 · Other software · Halo · reported by MITREMedium 6.1
halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 10, 2023An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.CVE-2023-27164 · Other software · Halo · reported by MITREMedium 4.8
An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 17, 2022 Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation.CVE-2022-36784 · Other software · Elsight · reported by cna@cyber.gov.ilCritical 9.8
Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution.
- Product
- Elsight Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.CVE-2022-32995 · Other software · Halo · reported by MITRECritical 9.8
Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.CVE-2022-32994 · Other software · Halo · reported by MITRECritical 9.8
Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.CVE-2022-28074 · Other software · Fit2cloud · reported by MITREMedium 4.8
Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.CVE-2022-26619 · Other software · Halo · reported by MITREHigh 7.5
Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.