Skip to content
OpenAdvisories
Unscored CVE-2022-40257 EUVD-2022-43555GHSA-3g24-rv7h-5xh5

An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

Published Oct 10, 2022 · Updated Aug 3, 2024 · Assigned by certcc

Vendor: CERT/CC Product: VINCE - The Vulnerability Information and Coordination Environment

Description

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field.

Affected products

VendorProductAffectedFixed
CERT/CC VINCE - The Vulnerability Information and Coordination Environment 1.48.0 – < 1.50.4 1.50.4

References