Filtered by vendor Cert Subscriptions
Filtered by product Vince Subscriptions

Search

Switch to Advanced Search (Beta)
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-8142 1 Cert 1 Vince 2026-05-11 6.5 Medium
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.
CVE-2024-10469 1 Cert 1 Vince 2025-08-25 4.4 Medium
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
CVE-2022-40238 1 Cert 1 Vince 2025-05-07 8.8 High
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.
CVE-2024-9953 1 Cert 1 Vince 2025-03-20 4.9 Medium
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.
CVE-2022-40257 1 Cert 1 Vince 2024-11-21 5.4 Medium
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
CVE-2022-40248 1 Cert 1 Vince 2024-11-21 5.4 Medium
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
CVE-2022-25799 1 Cert 1 Vince 2024-11-21 6.1 Medium
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks the link, the authenticated user's browser could be redirected to a malicious site that is designed to impersonate a legitimate website. The attacker could trick the user and potentially acquire sensitive information such as the user's credentials.