CVE-2025-70886

CVE-2025-70886 एक प्रूफ ऑफ कॉन्सेप्ट PoC शोषण CVE-2025-70886 के लिए, जो Halo CMS v2.22.4 और पुराने में एक स्थायी सेवा-अस्वीकार denial-of-service कमजोरी है, जो दूरस्थ हमलावरों को दोषपूर्ण पेलोड सबमिट करके एडमिन कमेंट इंटरफ़ेस को क्रैश करने की अनुमति देता है। मूलभूत जानकारी उत्पाद विक्रेता: 凌霞软件...

mangy-beast

Mangy Beast Red Hat होस्ट्स पर Apache और modssl या modnss चलाने वाले, तथा Windows Server 2008 और 2012 केवल सर्वर प्रक्रियाएँ के लिए CVE-2014-3566 उर्फ POODLE की संवेदनशीलता का पता लगाने हेतु CloudPassage Halo नीति =========== हम CVE-2014-3566, जिसे POODLE के नाम से भी जाना जाता है, के बारीक विवरण...

halo-record

halo-record Registros de runtime à prova de adulteração para agentes de IA : a trilha de auditoria que o fornecedor executa, mas não pode editar. Cada ação do seu agente chamadas de ferramentas, chamadas de modelo, acesso a dados, aprovações vira um registro em um log de estrutura anexada e...

halo-cve-2026-67919

ثغرة RCE في إضافة halo من رابط تتيح لوحة تحكم هالو للمشرفين تثبيت الإضافات وترقيتها بلصق رابط. فهي تجلب أي عنوان URL، تثبّت ملف jar، ويُشغَّل كود ملف jar على الخادم. لا توجد فحوصات على البروتوكول، ولا على المضيف، وتُتبع عمليات إعادة التوجيه، ويقوم مدير الإضافات بتحميل فئات الامتداد مباشرة من داخل...

CVE-2026-67920

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

EUVD-2026-60544

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

EUVD-2026-61145

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2026-67920

Halo 2.25.4's MigrationServiceImpl.restoreWorkdir() fetches an arbitrary URL, extracts the zip's workdir/ into the Halo work dir unsanitized via FileSystemUtils.copyRecursively(), replacing the entire extension store and enabling RCE. A working exploit (exploit/migration_restore.py) is verified a...

CVE-2026-67921

Halo CMS (versions up to 2.25.4 ) is affected by a CSRF/CORS misconfiguration in CorsConfigurer.java and CsrfConfigurer.java. The console API does not validate XSRF tokens, the session cookie uses SameSite=None, and CORS reflects any origin with credentials. This enables a browser-based attack ch...

EUVD-2026-61093

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

CVE-2026-67920

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

CVE-2026-67919

Halo (open-source CMS) version 2.25.4 is vulnerable to remote code execution via the installFromUri method in PluginEndpoint.java and DefaultPluginApplicationContextFactory. The plugin installation endpoint fetches an arbitrary URL without scheme or host validation, downloads the JAR, and loads i...

PT-2026-76880

Name of the Vulnerable Software and Affected Versions Halo version 2.25.4 Description A remote attacker can execute arbitrary code through the installFromUri method within PluginEndpoint.java and the DefaultPluginApplicationContextFactory components. Recommendations At the moment, there is no...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

CVE-2026-67919

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...

CVE-2026-16088

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...