CERTCC
Products
2- 7 CVEs
- 2 CVEs
Recent CVEs
9| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-8142 | Med | 0.42 | 6.5 | 0.00 | May 7, 2026 | VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates. | ||
| CVE-2026-35467 | Hig | 0.42 | 7.5 | 0.00 | Apr 2, 2026 | The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials. | ||
| CVE-2026-35466 | Med | 0.33 | 6.1 | 0.00 | Apr 2, 2026 | XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services | ||
| CVE-2024-10469 | 0.00 | — | 0.00 | Oct 28, 2024 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. | |||
| CVE-2024-9953 | 0.00 | — | 0.00 | Oct 14, 2024 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the… | |||
| CVE-2022-40238 | 0.00 | — | 0.01 | Oct 26, 2022 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed. | |||
| CVE-2022-40257 | 0.00 | — | 0.00 | Oct 10, 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field. | |||
| CVE-2022-40248 | 0.00 | — | 0.00 | Oct 10, 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field. | |||
| CVE-2022-25799 | 0.00 | — | 0.00 | Aug 16, 2022 | An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be… |
- risk 0.42cvss 6.5epss 0.00
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.
- risk 0.42cvss 7.5epss 0.00
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
- risk 0.33cvss 6.1epss 0.00
XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services
- CVE-2024-10469Oct 28, 2024risk 0.00cvss —epss 0.00
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
- CVE-2024-9953Oct 14, 2024risk 0.00cvss —epss 0.00
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the…
- CVE-2022-40238Oct 26, 2022risk 0.00cvss —epss 0.01
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.
- CVE-2022-40257Oct 10, 2022risk 0.00cvss —epss 0.00
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
- CVE-2022-40248Oct 10, 2022risk 0.00cvss —epss 0.00
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
- CVE-2022-25799Aug 16, 2022risk 0.00cvss —epss 0.00
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be…