Oracle Retail Eftlink vulnerabilities

11 CVEs affecting Oracle Retail Eftlink, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46943, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2021-34429, published 2021-07-15. Medium severity, CVSS 5.3. EPSS: 99.3% chance of exploitation in the next 30 days. For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…
CVE-2020-27218, published 2020-11-28. Medium severity, CVSS 4.8. EPSS: 8.3% chance of exploitation in the next 30 days. In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients…
CVE-2020-9488, published 2020-04-27. Low severity, CVSS 3.7. EPSS: 8.2% chance of exploitation in the next 30 days. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log…
CVE-2020-11979, published 2020-10-01. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task…
CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…
CVE-2021-36373, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…

Latest

CVE-2026-46943, published 2026-07-21. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability…