70 matches found
CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...
CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...
VINCE 安全漏洞
VINCE is an open source vulnerability information and coordination environment developed and used by the CERT Coordination Center in the United States. Vulnerability disclosure for improved coordination. A security vulnerability exists in VINCE versions prior to 3.0.9 that stems from the easy...
PT-2024-16298 · Vince · Vince
Name of the Vulnerable Software and Affected Versions: VINCE versions prior to 3.0.9 Description: The issue allows exposure of user information to authenticated users. Recommendations: For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue...
CVE-2024-10469: Incorrect Default Permissions
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...
CVE-2024-9953
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
CVE-2024-9953
CERT VINCE before version 3.0.8 is affected by a DoS vulnerability where an authenticated administrative user can inject an arbitrary pickle object into a user profile. Accessing the profile may trigger a DoS condition, even though Django restricts unpickling to prevent crashes. Reported in multi...
VINCE 安全漏洞
VINCE is an open source vulnerability information and coordination environment developed and used by the CERT Coordination Center in the United States. Vulnerability disclosure for improved coordination. A security vulnerability exists in VINCE versions prior to 3.0.8 that originates from an...
CVE-2024-9953: Deserialization of Untrusted Data
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
Osprey Pump Controller 1.0.1 Unauthenticated Remote Code Execution Exploit
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
Osprey Pump Controller 1.0.1 (pseudonym) Semi-blind Command Injection
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
Osprey Pump Controller 1.0.1 (eventFileSelected) Command Injection
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
Osprey Pump Controller 1.0.1 Predictable Session Token / Session Hijack
Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...
CERT Coordination Center VINCE代码问题漏洞
VINCE is a CERT Coordination Center in the United States CERT Coordination Center open source a CERT Coordination Center development and use of vulnerability information and coordination environment. Vulnerability disclosure for improved coordination. A security vulnerability exists in CERT...
The vulnerability of the CERT/CC VINCE software coordination mechanism lies in its lack of measures to neutralize special elements, allowing attackers to inject arbitrary HTML code.
The vulnerability of the CERT/CC VINCE software coordination mechanism exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely, using the “Product Affected” field...
CVE-2022-40248
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...
CVE-2022-40257
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...