CERT/CC

The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared.

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5.

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due to encoding confusion and use the from address for automated actions such as Ticket creation or Ticket updates.

vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's contact belongs to the requesting group-admin.

Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks _is_my_case, not ownership of kwargs['member'].

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0.

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4.

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4.

A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8.