CVE-2019-16890

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...

CVE-2020-19007

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...

CVE-2020-19007: Improper Neutralization of Input During Web Page Generation

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...

PT-2020-15154

Name of the Vulnerable Software and Affected Versions Halo blog version 1.2.0 Description The issue allows attackers to submit comments on blog posts via the "/api/content/posts/comments" API endpoint. The JavaScript code supplied by the attacker will then execute in the victim user's browser...

CVE-2019-16890

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...

CVE-2019-16890: Improper Neutralization of Input During Web Page Generation

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments...

PT-2019-14847

Name of the Vulnerable Software and Affected Versions Halo version 1.1.0 Description The issue allows for XSS via a crafted authorUrl in JSON data to the "api/content/posts/comments" API endpoint. Recommendations For Halo version 1.1.0, avoid using the authorUrl variable in the...