Approved changes feed: RSS · Atom
cpe:2.3:a:cert/cc:vince:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cert/Cc (aac4cca4-7ea6-5fd3-b45a-07513e58b290) |
|---|---|
| Product | Vince (d2f7a705-83cf-5167-b4aa-1681588db536) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-18744 |
vulnerable | 2026-09-16 04:34:01.889347 |
CVE-2026-18744
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member']. Bypasses share_status; leaks embargoed vendor affected/not-affected + statement text cross-tenant.
Published: 2026-08-12T21:11:19.926Z
Updated: 2026-08-13T15:45:30.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18750 |
vulnerable | 2026-09-16 04:34:01.764086 |
CVE-2026-18750
vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing (or read email/name) for another vendor's contact.
Published: 2026-08-12T21:09:15.989Z
Updated: 2026-08-13T15:47:52.245Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-18749 |
vulnerable | 2026-09-16 04:34:01.684469 |
CVE-2026-18749
The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has (or is sent) its uuid — leaks not-yet-released coordinator material to vendors on the case.
Published: 2026-08-12T21:10:19.828Z
Updated: 2026-08-13T15:46:38.941Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8142 |
vulnerable | 2026-06-08 08:08:58.145063 |
CVE-2026-8142
VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.
Published: 2026-05-07T19:54:49.275Z
Updated: 2026-06-05T16:26:58.167Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10469 |
vulnerable | 2026-06-08 06:23:46.681004 |
CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
Published: 2024-10-28T15:38:29.062Z
Updated: 2025-08-25T22:10:00.825Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.