Oracle Retail Point-Of-Service vulnerabilities

18 CVEs affecting Oracle Retail Point-Of-Service, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45105, published 2021-12-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2021-45105, published 2021-12-18. Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over…
CVE-2020-5398, published 2020-01-17. High severity, CVSS 7.5. EPSS: 88.8% chance of exploitation in the next 30 days. In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2018-8013, published 2018-05-24. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of…
CVE-2019-13990, published 2019-07-26. Critical severity, CVSS 9.8. EPSS: 16.6% chance of exploitation in the next 30 days. initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2020-11987, published 2021-02-24. High severity, CVSS 8.2. EPSS: 13.3% chance of exploitation in the next 30 days. Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this…
CVE-2019-17566, published 2020-11-12. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this…
CVE-2021-36374, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.6% chance of exploitation in the next 30 days. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs.…

Latest

CVE-2021-2351, published 2021-07-21. High severity, CVSS 8.3. EPSS: 2.4% chance of exploitation in the next 30 days. Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows…
CVE-2021-36373, published 2021-07-14. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used…
CVE-2020-1945, published 2020-05-14. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The…
CVE-2020-5397, published 2020-01-17. Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days. Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module)…