Oracle Retail Sales Audit vulnerabilities

20 CVEs affecting Oracle Retail Sales Audit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-10650, published 2022-12-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2020-9548, published 2020-03-02. Critical severity, CVSS 9.8. EPSS: 18.9% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2019-2904, published 2019-10-16. Critical severity, CVSS 9.8. EPSS: 14.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily…
CVE-2019-20330, published 2020-01-03. Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2020-10673, published 2020-03-18. High severity, CVSS 8.8. EPSS: 8% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-11113, published 2020-03-31. High severity, CVSS 8.8. EPSS: 6.3% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-11620, published 2020-04-07. High severity, CVSS 8.1. EPSS: 5.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2019-16942, published 2019-10-01. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed…
CVE-2019-17531, published 2019-10-12. Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed…
CVE-2019-16943, published 2019-10-01. Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed…

Latest

CVE-2020-10650, published 2022-12-26. High severity, CVSS 8.1. EPSS: 3.5% chance of exploitation in the next 30 days. A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core:…
CVE-2020-36518, published 2022-03-11. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVE-2020-11619, published 2020-04-07. High severity, CVSS 8.1. EPSS: 3.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka…
CVE-2020-11112, published 2020-03-31. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka…
CVE-2020-11111, published 2020-03-31. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool,…
CVE-2020-10969, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVE-2020-10968, published 2020-03-26. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).