CyberSecBulletin

Halo Service Solutions vulnerabilities

We track 2 vulnerabilities in Halo Service Solutions products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2024.

2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score

Latest Halo Service Solutions vulnerabilities

  • 8.1 High severity

    HaloITSM: Weak Password Recovery Mechanism for Forgotten Password

    CVE-2024-6203Halo Service Solutions

    HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the vi

  • 9.8 Critical severity

    HaloITSM: Incorrect Authorization

    CVE-2024-6202Halo Service Solutions

    HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions pas