Vignette's vulnerability footprint centers on its content management and web application platform products, including StoryServer, Content Suite, and Application Portal, which were widely deployed in enterprise publishing and portal environments. Its disclosures are marked by a moderate tendency toward serious severity outcomes and an elevated tendency to acquire public exploit code, reflecting the web-facing and data-handling role these systems occupy. Defenders tracking this vendor should focus on the recurring exposure patterns around sensitive information disclosure and input-handling weaknesses; live severity, exploitation, and coverage counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Vignette over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-18941CRITICAL In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,16 | Jan 31, 2019 | 9.8 | 30 | NO | NO |
CVE-2003-0400MEDIUM Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using | Jun 30, 2003 | 5.0 | 23 | NO | YES |
CVE-2003-0404MEDIUM Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, allow remote attackers to insert arbitrary HTML and script via text v | Jun 30, 2003 | 4.3 | 21 | NO | YES |
CVE-2003-0398HIGH Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, with the SSI EXEC feature enabled, allows remote attackers to execute arbitrary code via a text variable to a Vignette Appli | Jul 2, 2003 | 7.5 | 20 | NO | NO |
CVE-2003-0403HIGH Vignette StoryServer 5 and Vignette V/5 allows remote attackers to read and modify license information, and cause a denial of service (service halt) by directly accessing the /vgn/ | Jun 30, 2003 | 7.5 | 20 | NO | NO |
CVE-2008-6412HIGH Unspecified vulnerability in Vignette Content Management 7.3.0.5, 7.3.1, 7.3.1.1, 7.4, and 7.5 allows "low privileged" users to gain administrator privileges via unknown attack vec | Mar 6, 2009 | 7.5 | 19 | NO | NO |
CVE-2004-0917MEDIUM The default installation of Vignette Application Portal installs the diagnostic utility without authentication requirements, which allows remote attackers to gain sensitive informa | Jan 27, 2005 | 5.0 | 19 | NO | NO |
CVE-2003-0399MEDIUM Vignette StoryServer 4 and 5, Vignette V/5, and possibly other versions allows remote attackers to perform unauthorized SELECT queries by setting the vgn_creds cookie to an arbitra | Jul 2, 2003 | 6.4 | 17 | NO | NO |
CVE-2002-0385MEDIUM Vignette Story Server 4.1 and 6.0 allows remote attackers to obtain sensitive information via a request that contains a large number of '"' (double quote) and and '>' characters, w | Jun 1, 2004 | 5.0 | 15 | NO | NO |
CVE-2003-0401MEDIUM Vignette StoryServer and Vignette V/5 allows remote attackers to obtain sensitive information via a request for the /vgn/style template. | Jun 30, 2003 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Vignette.
Media articles that mention a CVE ID that affects a product developed by Vignette — matched by CVE ID, not by vendor name.