İçeriğe atla
Noroxi

halo kayıtları

halo üreticisine ait 33 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
3
Düzeltme kaydı olan
%12,1
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

33 kayıt
  • CVE-2022-32994
    45Planlayın

    Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload.

    KritikCVSS 9,8İstismar yokEPSS %18

    halo · halo27 Haz 2022

  • CVE-2022-32995
    44Planlayın

    Halo CMS v1.5.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the template remote download function.

    KritikCVSS 9,8İstismar yokEPSS %17

    halo · halo27 Haz 2022

  • CVE-2020-21523
    40Planlayın

    A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function.

    KritikCVSS 9,8İstismar yokEPSS %2

    halo · halo30 Eyl 2020

  • CVE-2020-21526
    40Planlayın

    An Arbitrary file writing vulnerability in halo v1.1.3.

    KritikCVSS 9,8İstismar yokEPSS %1

    halo · halo30 Eyl 2020

  • CVE-2020-21522
    39İzleyin

    An issue was discovered in halo V1.1.3.

    KritikCVSS 9,8İstismar yokEPSS %1

    halo · halo30 Eyl 2020

  • CVE-2020-18980
    39İzleyin

    Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.

    KritikCVSS 9,8İstismar yokEPSS %1

    halo · halo12 Tem 2021

  • CVE-2020-21524
    36İzleyin

    There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the background(/api/admin/migrat

    KritikCVSS 9,1İstismar yokEPSS %1

    halo · halo30 Eyl 2020

  • CVE-2020-19038
    36İzleyin

    File Deletion vulnerability in Halo 0.4.3 via delBackup.

    KritikCVSS 9,1İstismar yokEPSS %1

    halo · halo12 Tem 2021

  • CVE-2025-44594
    36İzleyin

    halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-

    KritikCVSS 9,1İstismar yokEPSS %0

    halo · halo9 Eyl 2025

  • CVE-2020-21525
    31İzleyin

    Halo V1.1.3 is affected by: Arbitrary File reading.

    YüksekCVSS 7,5İstismar yokEPSS %1

    halo · halo30 Eyl 2020

  • CVE-2020-23079
    30İzleyin

    SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.

    YüksekCVSS 7,5İstismar yokEPSS %1

    halo · halo12 Tem 2021

  • CVE-2020-21527
    30İzleyin

    There is an Arbitrary file deletion vulnerability in halo v1.1.3.

    YüksekCVSS 7,7İstismar yokEPSS %1

    halo · halo30 Eyl 2020

  • CVE-2022-26619
    30İzleyin

    Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function.

    YüksekCVSS 7,5İstismar yokEPSS %0

    halo · halo4 Nis 2022

  • CVE-2025-70886
    30İzleyin

    An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submi

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    halo · halo12 Şub 2026

  • CVE-2019-19999
    28İzleyin

    Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMa

    YüksekCVSS 7,2İstismar yokEPSS %1

    halo · halo26 Ara 2019

  • CVE-2024-43793
    25İzleyin

    Halo's editor has a stored XSS vulnerability

    OrtaCVSS 6,4İstismar yokEPSS %0

    halo · halo11 Eyl 2024

  • CVE-2020-21345
    24İzleyin

    Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user e

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo20 May 2021

  • CVE-2020-18979
    24İzleyin

    Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo12 Tem 2021

  • CVE-2018-11011
    24İzleyin

    ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo12 May 2018

  • CVE-2018-11012
    24İzleyin

    ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo12 May 2018

  • CVE-2024-43792
    24İzleyin

    Halo's editor has a stored Cross-Site Scripting vulnerability

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo2 Eyl 2024

  • CVE-2023-33528
    24İzleyin

    halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo28 Mar 2024

  • CVE-2025-44593
    24İzleyin

    Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files.

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo9 Eyl 2025

  • CVE-2025-44595
    24İzleyin

    Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.

    OrtaCVSS 6,1İstismar yokEPSS %0

    halo · halo9 Eyl 2025

  • CVE-2024-56156
    22İzleyin

    Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

    OrtaCVSS 5,5İstismar yokEPSS %0

    halo · halo25 Nis 2025