Skip to content
OpenAdvisories

Package · RubyGems

spree

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium —
    GHSA-xf4v-w5x5-pv79

    Spree: CSV Formula Injection in Customer Export

    ### Summary CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or Li…

    spree RubyGems
  • Critical 9.3
    CVE-2011-10026 Public exploit

    Spreecommerce < 0.50.x API RCE

    Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamica…

    Spreecommerce Spreecommerce spree rd_searchlogic RubyGems
  • Critical 10.0
    CVE-2011-10019 Public exploit

    Spreecommerce < 0.60.2 Search Parameter RCE

    Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send meth…

    Spreecommerce Spreecommerce spree RubyGems
  • High 7.4
    CVE-2020-15269

    Expired token reuse in Spree

    In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

    spree spree spree RubyGems
  • Medium —
    CVE-2013-1656

    Spree Improper Input Validation vulnerability

    Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the …

    spree RubyGems
  • Medium —
    CVE-2008-7310

    Spree does not properly restrict the use of a hash to provide values for a model's attributes

    Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerabili…

    spree RubyGems
  • Medium —
    CVE-2008-7311

    Spree uses a hardcoded hash value

    The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that co…

    spree RubyGems
  • Medium —
    CVE-2010-3978

    Spree allows remote attackers to obtain sensitive information

    Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json…

    spree RubyGems