CyberSecBulletin

Haloservicesolutions vulnerabilities

We track 2 vulnerabilities in Haloservicesolutions products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 6, 2024.

2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score

Latest Haloservicesolutions vulnerabilities

  • 8.1 High severity

    HaloITSM: Weak Password Recovery Mechanism for Forgotten Password

    CVE-2024-6203Halo Service Solutions

    HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the vi

  • 9.8 Critical severity

    HaloITSM: Incorrect Authorization

    CVE-2024-6202Halo Service Solutions

    HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions pas