Cert
Cert Vince: vulnerabilidades y CVE
Cert Vince tiene 7 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses1
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-8142 | Media (6.5) | 0.15% | — | 7 may 2026 | VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates. |
| CVE-2024-10469 | Media (6.5) | 0.18% | — | 28 oct 2024 | VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. |
| CVE-2024-9953 | Media (4.9) | 0.44% | — | 14 oct 2024 | A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead… |
| CVE-2022-40238 | Alta (8.8) | 1.3% | — | 26 oct 2022 | A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the… |
| CVE-2022-40257 | Media (5.4) | 0.39% | — | 10 oct 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field. |
| CVE-2022-40248 | Media (5.4) | 0.41% | — | 10 oct 2022 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field. |
| CVE-2022-25799 | Media (6.1) | 0.57% | — | 16 ago 2022 | An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated user clicks… |