Vince
Monthly
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.44 lets any authenticated member of a coordination case retrieve coordinator-uploaded attachments that were never marked as shared. The type=track download branch checks only case membership (_is_my_case) and omits the VinceTrackAttachment.shared gate, so a vendor on a case who knows or is sent an artefact's UUID can pull not-yet-released coordinator material. EPSS is low (0.15%, 4th percentile) and no public exploit is identified; this is a logic/authorization defect fixed upstream in PR #235.
Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargoed CaseStatement and per-vulnerability CaseMemberStatus records by supplying an arbitrary member ID in the API request. The authorization check in test_func validates only that the requester is a participant in the case (_is_my_case) but does not verify that the requested member ID belongs to their own organization, making the share_status embargo control bypassable. Affected versions are all VINCE releases before 3.0.44; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to manipulate or read notification configuration for contacts belonging to other vendors. The ModifyEmailNotifications view in vinny/views.py resolves a VinceCommEmail record by raw primary key supplied in the URL without verifying that the targeted record belongs to the requesting admin's own vendor group, enabling unauthorized cross-tenant read and write of email routing settings. No public exploit has been identified and EPSS is negligible (0.15%), but the flaw undermines the trust isolation between vendor tenants in a vulnerability coordination context.
VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowing unauthenticated remote attackers to forge email From addresses and trigger automated actions such as ticket creation or updates. The vulnerability combines information disclosure with integrity impact, affecting the reliability of ticket management workflows that depend on sender validation.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.44 lets any authenticated member of a coordination case retrieve coordinator-uploaded attachments that were never marked as shared. The type=track download branch checks only case membership (_is_my_case) and omits the VinceTrackAttachment.shared gate, so a vendor on a case who knows or is sent an artefact's UUID can pull not-yet-released coordinator material. EPSS is low (0.15%, 4th percentile) and no public exploit is identified; this is a logic/authorization defect fixed upstream in PR #235.
Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargoed CaseStatement and per-vulnerability CaseMemberStatus records by supplying an arbitrary member ID in the API request. The authorization check in test_func validates only that the requester is a participant in the case (_is_my_case) but does not verify that the requested member ID belongs to their own organization, making the share_status embargo control bypassable. Affected versions are all VINCE releases before 3.0.44; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to manipulate or read notification configuration for contacts belonging to other vendors. The ModifyEmailNotifications view in vinny/views.py resolves a VinceCommEmail record by raw primary key supplied in the URL without verifying that the targeted record belongs to the requesting admin's own vendor group, enabling unauthorized cross-tenant read and write of email routing settings. No public exploit has been identified and EPSS is negligible (0.15%), but the flaw undermines the trust isolation between vendor tenants in a vulnerability coordination context.
VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowing unauthenticated remote attackers to forge email From addresses and trigger automated actions such as ticket creation or updates. The vulnerability combines information disclosure with integrity impact, affecting the reliability of ticket management workflows that depend on sender validation.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.