Oracle Retail Data Extractor For Merchandising vulnerabilities

3 CVEs affecting Oracle Retail Data Extractor For Merchandising, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45105, published 2021-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…
CVE-2020-1945, published 2020-05-14. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The…