Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
halo vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2020-21525
Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory traversal check is performed on the input path parameter, but the startsWith function can be used to bypass it.
Halo Halo 1.1.3
7.7
CVSSv3
CVE-2020-21527
There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal.
Halo Halo 1.1.3
7.5
CVSSv3
CVE-2022-26619
Halo Blog CMS v1.4.17 exists to allow malicious users to upload arbitrary files via the Attachment Upload function.
Halo Halo 1.4.17
5.4
CVSSv3
CVE-2019-16890
Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.
Halo Halo 1.1.0
NA
CVE-2004-1539
Halo: Combat Evolved 1.05 and previous versions allows remote game servers to cause a denial of service (client crash) via a long value in a game server reply, which triggers a NULL dereference.
Gearbox Software Halo Combat Evolved 1.2
Gearbox Software Halo Combat Evolved 1.31
Gearbox Software Halo Combat Evolved 1.4
Gearbox Software Halo Combat Evolved 1.5
1 EDB exploit
NA
CVE-2004-1667
Off-by-one error in Halo Combat Evolved 1.04 and previous versions allows remote malicious users to cause a denial of service (server crash) via a long client response.
Gearbox Software Halo Combat Evolved 1.2
Gearbox Software Halo Combat Evolved 1.31
Gearbox Software Halo Combat Evolved 1.4
5.4
CVSSv3
CVE-2022-22123
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server.
Fit2cloud Halo
5.4
CVSSv3
CVE-2022-22124
In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser.
Fit2cloud Halo
4.8
CVSSv3
CVE-2022-28074
Halo-1.5.0 exists to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools.
Fit2cloud Halo 1.5.0
7.1
CVSSv3
CVE-2019-5625
The Android mobile application Halo Home prior to 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an malicious user to impersonate...
Eaton Halo Home 1.9.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
SSRF
buffer overflow
CVE-2023-28952
CVE-2023-41822
CVE-2024-27956
CVE-2023-7028
CVE-2024-34447
CVE-2024-34460
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »