Skip to content
OpenAdvisories

Archive

4 April 2012

Vulnerabilities first published on this day (UTC), newest first.

← March 2012 2012 / April /4 May 2012 →
  1. 1 
  2. 211
  3. 36
  4. 417
  5. 515
  6. 66
  7. 7 
  8. 8 
  9. 95
  10. 1016
  11. 1121
  12. 124
  13. 1315
  14. 14 
  15. 15 
  16. 162
  17. 1711
  18. 1814
  19. 193
  20. 208
  21. 216
  22. 2211
  23. 23 
  24. 241
  25. 2539
  26. 26 
  27. 276
  28. 286
  29. 29 
  30. 305
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium —
    CVE-2008-7310

    Spree does not properly restrict the use of a hash to provide values for a model's attributes

    Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerabili…

    spree RubyGems
  • Medium —
    CVE-2008-7311

    Spree uses a hardcoded hash value

    The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that co…

    spree RubyGems