Oracle Retail Workforce Management Software vulnerabilities

6 CVEs affecting Oracle Retail Workforce Management Software, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-19362, published 2019-01-02.

More from Oracle.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-9251, published 2018-01-18. Medium severity, CVSS 6.1. EPSS: 29.7% chance of exploitation in the next 30 days. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
• CVE-2018-14718, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 12.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
• CVE-2018-19362, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
• CVE-2018-19361, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
• CVE-2018-19360, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
• CVE-2018-14719, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 9.7% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic…