Oracle Commerce Merchandising vulnerabilities

8 CVEs affecting Oracle Commerce Merchandising, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-24729, published 2022-03-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-24729, published 2022-03-16. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog…
CVE-2021-26272, published 2021-01-26. Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days. It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink…
CVE-2020-27193, published 2020-11-12. Medium severity, CVSS 6.1. EPSS: 2% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML…
CVE-2021-37695, published 2021-08-13. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)…
CVE-2022-24728, published 2022-03-16. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to…
CVE-2021-32808, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability…
CVE-2021-32809, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package.…
CVE-2019-2713, published 2019-04-23. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Commerce Merchandising component of Oracle Commerce (subcomponent: Asset Manager). The supported version that is affected is 11.2.0.3. Easily exploitable vulnerability…