Components Vulnerabilities Pricing MCP API

spree 0.11.1 | Vulnerabilities | Sonatype Guide

spree

0.11.1

spree 0.11.1

PublishedOct 11, 2010•Policy

compliance

Developer Trust Score

N/A

Recommended Version:x.y.z

Latest version with 0 known vulnerabilities that meets your policy.

Compare Versions

Severity

Critical (0)

High (0)

Medium (10)

Low (0)

CVSS Score

0.010.0

EPSS Score

0.01.0

Malware

KEV StatusPublished

6.1CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

PublishedJul 29, 2022

6.5sonatype-2020-0998

spree - Information Disclosure

PublishedOct 14, 2020

4.3sonatype-2019-0802

spree - Information Exposure

PublishedApr 16, 2020

5.9sonatype-2019-0446

Spree - Cross-Site Scripting (XSS) In Admin Product Editor

PublishedNov 4, 2019

6.1sonatype-2016-0585

Spree - Cross-Site Scripting (XSS) across several input fields

PublishedDec 6, 2018

6.1sonatype-2012-0072

spree - Potential Cross Site Scripting (XSS) via Ecommerce Tracking Code

PublishedJul 6, 2018

5.0CVE-2010-3978

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.

PublishedMar 7, 2018

6.5sonatype-2014-0026

jQuery - Cross-Site Scripting (XSS)

6.1sonatype-2016-0107

jQuery - Cross-Site Scripting (XSS) [CVE-2015-9251]

6.1sonatype-2012-0009

JQuery - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Mar 28, 2017

Published

Mar 28, 2017

Published

Mar 28, 2017