Security

Blocked HTML Content in Rich Text Editors

CVE-2024-6200 - Stored Cross-Site Scripting in Tickets

CVE-2024-6201 - Emailing Template Injection

CVE-2024-6202 - SAML XML Signature Wrapping (XSW)

CVE-2024-6203 - Password Reset Poisoning

Data Storage And Security

Enable HTTP strict transport security (HSTS)

Enabling Reference Tokens

Enabling Secure Cookies in the Web Application

Google reCAPTCHA Integration

How are user passwords stored?

Http to Https redirect in web app

IP Addresses for Whitelisting

The article provides a list of IP addresses to whitelist for hosted Halo users, covering different regions: UK, USA/Americas, AUS/APAC, DE/Frankfurt/EU, CA/Canada, ZA, and Bahrain. These IP addresses are essential for allowing API requests and email connections through SMTP/IMAP/POP. The article also advises adding specific DNS listings to the sending domain's SPF record for proper email delivery.

Protect token signing keys with a certificate

Read-only connection for reports

Setting up Two Factor Authentication

The article provides guidance on setting up Two-Factor Authentication (2FA) to enhance security for Halo accounts. It offers instructions for enabling 2FA for personal accounts, either via email/SMS or an authenticator app like Google or Microsoft Authenticator. The summary includes steps to enable 2FA individually and also how to enforce it for all agents and users through security settings in the Halo configuration. The use of 2FA is recommended for data protection and added security, especially when accessing Halo on mobile devices or in public spaces.

SQL Injection Vulnerability Patched

Update to SAML Validation

X.509 for encryption