deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45522
Published: 2024-09-02
Description: Linen before cd37c3e does not verify that the domain is linen.dev or www.linen.dev when resetting a password. This occurs in create in apps/web/pages/api/forgot-password/index.ts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/Linen-dev/linen.dev/commit/cd37c3e88ec29f4e7baae7e32fe80d0137848d10
CVE: CVE-2024-20084
Published: 2024-09-02
Description: In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08944210; Issue ID: MSV-1561.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-20085
Published: 2024-09-02
Description: In power, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08944204; Issue ID: MSV-1560.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-20086
Published: 2024-09-02
Description: In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1551.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-20087
Published: 2024-09-02
Description: In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1550.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-20088
Published: 2024-09-02
Description: In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932099; Issue ID: MSV-1543.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125, CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-20089
Published: 2024-09-02
Description: In wlan, there is a possible denial of service due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08861558; Issue ID: MSV-1526.
CVSS Score: 7.5 (HIGH)
CWE: CWE-703, CWE-754, CWE-754
References: https://corp.mediatek.com/product-security-bulletin/September-2024
CVE: CVE-2024-28044
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause crash through integer overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-190, CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-38382
Published: 2024-09-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-922, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-38386
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-39612
Published: 2024-09-02
Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-922, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-39775
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-922, CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-39816
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.
CVSS Score: 8.4 (HIGH)
CWE: CWE-787, CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-41157
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-41160
Published: 2024-09-02
Description: in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-09.md
CVE: CVE-2024-43772
Published: 2024-09-02
Description: SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-05
CVE: CVE-2024-43773
Published: 2024-09-02
Description: SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-06
CVE: CVE-2024-43774
Published: 2024-09-02
Description: SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-07
CVE: CVE-2024-43775
Published: 2024-09-02
Description: SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-08
CVE: CVE-2024-43776
Published: 2024-09-02
Description: SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-09
CVE: CVE-2024-45527
Published: 2024-09-02
Description: REDCap 14.7.0 allows HTML injection via the project title of a New Project action. This can lead to resultant logout CSRF via index.php?logout=1, and can also be used to insert a link to an external phishing website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/ShellFighter/Reports/blob/main/Vanderbilt%20REDCap%2014.7.0.md; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
CVE: CVE-2024-45528
Published: 2024-09-02
Description: CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ShellFighter/VulnerabilityResearch/blob/main/MMS.md
CVE: CVE-2024-7871
Published: 2024-09-02
Description: SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://zuso.ai/advisory/za-2024-04
CVE: CVE-2024-8365
Published: 2024-09-02
Description: Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices/
CVE: CVE-2024-7354
Published: 2024-09-02
Description: The Ninja Forms  WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3c871dcd-51d7-4d3b-b036-efa9e066ff41/
CVE: CVE-2024-7690
Published: 2024-09-02
Description: The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1f941d51-1eaf-424a-95b8-ccaa3fdd339b/
CVE: CVE-2024-7691
Published: 2024-09-02
Description: The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/d30a3b95-5d1f-4755-8b61-19946afc51ef/
CVE: CVE-2024-7692
Published: 2024-09-02
Description: The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5e9f98ef-5a44-4a0c-b9cd-ce750bec74f9/
CVE: CVE-2024-23358
Published: 2024-09-02
Description: Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-23359
Published: 2024-09-02
Description: Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
CVSS Score: 8.2 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-23362
Published: 2024-09-02
Description: Cryptographic issue while parsing RSA keys in COBR format.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-23364
Published: 2024-09-02
Description: Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
CVSS Score: 7.5 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-23365
Published: 2024-09-02
Description: Memory corruption while releasing shared resources in MinkSocket listener thread.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33016
Published: 2024-09-02
Description: memory corruption when an invalid firehose patch command is invoked.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33035
Published: 2024-09-02
Description: Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33038
Published: 2024-09-02
Description: Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33042
Published: 2024-09-02
Description: Memory corruption when Alternative Frequency offset value is set to 255.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33043
Published: 2024-09-02
Description: Transient DOS while handling PS event when Program Service name length offset value is set to 255.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33045
Published: 2024-09-02
Description: Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
CVSS Score: 8.4 (HIGH)
CWE: CWE-562, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33047
Published: 2024-09-02
Description: Memory corruption when the captureRead QDCM command is invoked from user-space.
CVSS Score: 8.4 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33048
Published: 2024-09-02
Description: Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33050
Published: 2024-09-02
Description: Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33051
Published: 2024-09-02
Description: Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33052
Published: 2024-09-02
Description: Memory corruption when user provides data for FM HCI command control operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33054
Published: 2024-09-02
Description: Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33057
Published: 2024-09-02
Description: Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-33060
Published: 2024-09-02
Description: Memory corruption when two threads try to map and unmap a single node simultaneously.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-38401
Published: 2024-09-02
Description: Memory corruption while processing concurrent IOCTL calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-38402
Published: 2024-09-02
Description: Memory corruption while processing IOCTL call for getting group info.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/september-2024-bulletin.html
CVE: CVE-2024-38858
Published: 2024-09-02
Description: Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://checkmk.com/werk/17232
CVE: CVE-2024-5148
Published: 2024-09-02
Description: A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-488
References: https://access.redhat.com/security/cve/CVE-2024-5148; https://bugzilla.redhat.com/show_bug.cgi?id=2282003; https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196
CVE: CVE-2024-7932
Published: 2024-09-02
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-7938
Published: 2024-09-02
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-7939
Published: 2024-09-02
Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-8004
Published: 2024-09-02
Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2020-36830
Published: 2024-09-02
Description: A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of the component Backtracking. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.5.1 is able to address this issue. The identifier of the patch is e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/nescalante/urlregex/commit/e5a085afe6abfaea1d1a78f54c45af9ef43ca1f9; https://github.com/nescalante/urlregex/pull/8; https://github.com/nescalante/urlregex/releases/tag/v0.5.1
CVE: CVE-2023-7279
Published: 2024-09-02
Description: A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/res/targets_schema.json of the component Delegation Name Handler. The manipulation leads to inefficient regular expression complexity. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 524b73ff7306707f6d3a4d1e86401479bca91b02. It is recommended to upgrade the affected component.
CVSS Score: 2.6 (LOW)
CWE: CWE-1333
References: https://github.com/sse-secure-systems/connaisseur/commit/524b73ff7306707f6d3a4d1e86401479bca91b02; https://github.com/sse-secure-systems/connaisseur/pull/1407; https://github.com/sse-secure-systems/connaisseur/releases/tag/v3.3.1
CVE: CVE-2024-28100
Published: 2024-09-02
Description: eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a list of experiments. Viewing this allows the malicious script to act on behalf of the visitor in any way, including the creation of API keys for persistence, or other options normally available to the user. If the user viewing the page has the sysadmin role in eLabFTW, the script can act as a sysadmin (including system configuration and extensive user management roles). Users are advised to upgrade to at least version 5.0.0. There are no known workarounds for this vulnerability.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/elabftw/elabftw/security/advisories/GHSA-xp3v-w8cx-cqxc
CVE: CVE-2024-42471
Published: 2024-09-02
Description: actions/artifact is the GitHub ToolKit for developing GitHub Actions.  Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExternal` for extracting a specifically crafted artifact that contains path traversal filenames. Users are advised to upgrade to version 2.1.2 or higher. There are no known workarounds for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/actions/toolkit/pull/1666; https://github.com/actions/toolkit/security/advisories/GHSA-6q32-hq47-5qq3; https://snyk.io/research/zip-slip-vulnerability
CVE: CVE-2024-43792
Published: 2024-09-02
Description: Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g