CVE-2024-6201

HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...

PT-2024-37448 · Haloitsm · Haloitsm

Name of the Vulnerable Software and Affected Versions: HaloITSM versions up to 2.146.1 Description: The issue allows malicious actors to send poisoned password reset links to existing users, given their email address is known. When these links are accessed, the password reset token is leaked,...

PT-2024-37445 · Haloitsm · Haloitsm

Name of the Vulnerable Software and Affected Versions: HaloITSM versions up to 2.146.1 Description: The issue is a Stored Cross-Site Scripting XSS vulnerability, where injected JavaScript code can execute arbitrary actions on behalf of the user accessing a ticket. Recommendations: For HaloITSM...