Oracle Retail Clearance Optimization Engine vulnerabilities

6 CVEs affecting Oracle Retail Clearance Optimization Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-12415, published 2019-10-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5645, published 2017-04-17. Critical severity, CVSS 9.8. EPSS: 89.8% chance of exploitation in the next 30 days. In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
CVE-2019-2904, published 2019-10-16. Critical severity, CVSS 9.8. EPSS: 14.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2018-11040, published 2018-06-25. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through…
CVE-2018-11039, published 2018-06-25. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including…
CVE-2019-12415, published 2019-10-23. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local…