Approved changes feed: RSS · Atom
cpe:2.3:a:haloservicesolutions:haloitsm:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Haloservicesolutions (0f9e429b-6de4-5c86-a60c-423602f31134) |
|---|---|
| Product | Haloitsm (ceb7599a-2fec-5626-bfac-f73e7cf0e9eb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-6203 |
vulnerable | 2026-06-08 06:58:18.156301 |
HaloITSM - Password Reset Poisoning
HIGH (8.3)
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Published: 2024-08-06T06:03:11.225Z
Updated: 2024-08-06T18:47:20.023Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6202 |
vulnerable | 2026-06-08 06:58:18.155895 |
HaloITSM - SAML XML Signature Wrapping (XSW)
CRITICAL (9.8)
HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured, anonymous actors could impersonate arbitrary HaloITSM users by just knowing their email address. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Published: 2024-08-06T06:01:41.415Z
Updated: 2024-08-08T13:43:27.833Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6201 |
vulnerable | 2026-06-08 06:58:18.155479 |
HaloITSM - Emailing Template Injection
MEDIUM (5.3)
HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Published: 2024-08-06T05:59:29.627Z
Updated: 2025-03-25T16:42:00.570Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6200 |
vulnerable | 2026-06-08 06:58:18.154329 |
HaloITSM - Stored Cross-Site Scripting in Tickets
HIGH (8)
HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute arbitrary action on behalf of the user accessing a ticket. HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Published: 2024-08-06T05:54:53.924Z
Updated: 2024-08-08T17:39:07.431Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.