Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-19999
7.2
HIGHCVSS v3
Published
December 26, 2019
CVSS v2
6.5 MEDIUM
Affected
2 projects
Assigned by
MITRE
Severity scale
010
Description
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
halo-dev/halo
GitHubHalo 是一款强大易用的开源建站工具，从个人博客、知识库，到企业官网、在线商城，Halo 都能助您轻松实现，一站式满足您的多样化建站需求。
GitHubHalo 是一款强大易用的开源建站工具，从个人博客、知识库，到企业官网、在线商城，Halo 都能助您轻松实现，一站式满足您的多样化建站需求。= 1.2.0, = 1.1.3, <= 1.1.1NVD