Vince
by CERTCC
Source repositories
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-18749 | Cri | 0.57 | 9.8 | 0.00 | Aug 12, 2026 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released… | ||
| CVE-2022-40238 | Hig | 0.57 | 8.8 | 0.01 | Oct 26, 2022 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed. | ||
| CVE-2026-8142 | Med | 0.42 | 6.5 | 0.00 | May 7, 2026 | VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates. | ||
| CVE-2024-10469 | Med | 0.42 | 6.5 | 0.00 | Oct 28, 2024 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. | ||
| CVE-2022-25799 | Med | 0.40 | 6.1 | 0.01 | Aug 16, 2022 | An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be… | ||
| CVE-2026-18744 | Med | 0.35 | 6.5 | 0.00 | Aug 12, 2026 | Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected +… | ||
| CVE-2022-40257 | Med | 0.35 | 5.4 | 0.00 | Oct 10, 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field. | ||
| CVE-2022-40248 | Med | 0.35 | 5.4 | 0.00 | Oct 10, 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field. | ||
| CVE-2024-9953 | Med | 0.32 | 4.9 | 0.00 | Oct 14, 2024 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the… | ||
| CVE-2026-18750 | Med | 0.27 | 5.3 | 0.00 | Aug 12, 2026 | vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for… |
- risk 0.57cvss 9.8epss 0.00
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released…
- risk 0.57cvss 8.8epss 0.01
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.
- risk 0.42cvss 6.5epss 0.00
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.
- risk 0.42cvss 6.5epss 0.00
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
- risk 0.40cvss 6.1epss 0.01
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be…
- risk 0.35cvss 6.5epss 0.00
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected +…
- risk 0.35cvss 5.4epss 0.00
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
- risk 0.35cvss 5.4epss 0.00
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
- risk 0.32cvss 4.9epss 0.00
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the…
- risk 0.27cvss 5.3epss 0.00
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for…