CVE-2024-43792

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437936.4Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. CVE-2024-437946.1OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Impr CVE-2024-437956.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functional CVE-2024-437964.7Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.red CVE-2024-437974.3audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones t CVE-2024-437988.6Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environme CVE-2024-437994.7Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() whi CVE-2024-438004.7serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted CVE-2024-438015.4Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS att CVE-2024-438024.5Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead b CVE-2024-438034.9The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The `BareMetalHost` (BMH) CRD allows the CVE-2024-438048.8Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any auth