CVE-2024-9953

CERT VINCE before version 3.0.8 is affected by a DoS vulnerability where an authenticated administrative user can inject an arbitrary pickle object into a user profile. Accessing the profile may trigger a DoS condition, even though Django restricts unpickling to prevent crashes. Reported in multi...

CVE-2022-40248

CERT/CC VINCE is affected by an HTML injection vulnerability in versions prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via the Product Affected field in a form, potentially impacting data or UI integrity. The vulnerability has been consistently described across multiple sou...

CVE-2022-25799

CERT/CC VINCE is affected by an open redirect vulnerability in versions prior to 1.50.0. An attacker can craft a URL that, when an authenticated user clicks it, redirects the user’s browser to a malicious site impersonating a legitimate one, potentially enabling credential exposure. The issue’s r...

CVE-2024-10469

CVE-2024-10469 affects VINCE before 3.0.9. The issue allows exposure of user information to authenticated users due to an access/control flaw in VINCE’s User Management view. Impact is user information disclosure; CVSS vectors in sources indicate medium base severity with confidentiality impact. ...

CVE-2022-40257

CVE-2022-40257 affects CERT/CC VINCE software prior to v1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML in the Subject field due to insufficient HTML sanitization. The vulnerability enables HTML injection in VINCE’s handling of email subjects, with CVSS v...

CVE-2022-40238

CVE-2022-40238 describes a Remote Code Injection in CERT software prior to 1.50.5. An authenticated attacker can inject arbitrary pickle objects as part of a user’s profile, leading to code execution on the server when the profile is accessed. Affected component is CERT software’s profile handlin...