Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

spree

7 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 critical, 1 high
Registry
RubyGems

Advisories 7

  • CVE-2011-10026Critical 9.3

    Spreecommerce < 0.50.x API RCE

    Affected: from 0.30.0.beta1, fixed in 0.50.0.

  • CVE-2011-10019Critical 10.0

    Spreecommerce < 0.60.2 Search Parameter RCE

    Affected: fixed in 0.60.2.

  • Expired token reuse in Spree

    Affected: fixed in 3.7.11; from 4.0.0, fixed in 4.0.4; from 4.1.0, fixed in 4.1.11.

  • Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary…

    Affected: from 1.0.0, fixed in 2.0.0.rc1.

  • The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key)…

    Affected: fixed in 0.4.0.

  • Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set…

    Affected: fixed in 0.4.0.

  • Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for…

    Affected: from 0.11.0, fixed in 0.11.2; from 0.30.0.beta1, fixed in 0.30.0.