Oracle Retail Financial Integration vulnerabilities

19 CVEs affecting Oracle Retail Financial Integration, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22965, published 2022-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2021-42340, published 2021-10-14. High severity, CVSS 7.5. EPSS: 11.8% chance of exploitation in the next 30 days. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics…
CVE-2022-23437, published 2022-01-24. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop,…
CVE-2020-5421, published 2020-09-19. Medium severity, CVSS 6.5. EPSS: 11.6% chance of exploitation in the next 30 days. In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed…
CVE-2018-15756, published 2018-10-18. High severity, CVSS 7.5. EPSS: 9.2% chance of exploitation in the next 30 days. Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving…
CVE-2020-11979, published 2020-10-01. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task…
CVE-2021-40690, published 2021-09-19. High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days. All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from…
CVE-2018-11039, published 2018-06-25. Medium severity, CVSS 5.9. EPSS: 2.7% chance of exploitation in the next 30 days. Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including…

Latest

CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…
CVE-2021-36373, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used…
CVE-2021-22118, published 2021-05-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory,…