VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
CVSS Score
6.5
EPSS Score
0.001
Published
2024-10-28
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.
CVSS Score
4.9
EPSS Score
0.003
Published
2024-10-14
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed.
CVSS Score
8.8
EPSS Score
0.022
Published
2022-10-26
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field.
CVSS Score
5.4
EPSS Score
0.001
Published
2022-10-10
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.
CVSS Score
5.4
EPSS Score
0.001
Published
2022-10-10