Oracle Retail Order Management System Cloud Service vulnerabilities

3 CVEs affecting Oracle Retail Order Management System Cloud Service, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11987, published 2021-02-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2016-0506, published 2016-01-21. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Retail Order Management System Cloud Service component in Oracle Retail Applications 3.5, 4.5, 4.7, 5.0, and 15.0 allows remote attackers to affect…