Latest oracle retail point-of-service Vulnerabilities

● CVE-2021-45105

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el8ea

redhat/eap7-log4j<0:2.17.1-1.redhat_00001.1.el7ea

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el7

redhat/rh-sso7-keycloak<0:15.0.6-1.redhat_00001.1.el8

debian/apache-log4j2

debian/apache-log4j2<=2.16.0-1~deb10u1<=2.16.0-1<=2.16.0-1~deb11u1

and 217 more

● CVE-2021-2351

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unau...

Oracle Advanced Networking Option=12.1.0.2

Oracle Advanced Networking Option=12.2.0.1

Oracle Advanced Networking Option=19c

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

Oracle Agile Product Lifecycle Management for Process=6.2.2.0

and 242 more

● CVE-2021-36374

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted ZIP archive, a remote a...

maven/org.apache.ant:ant>=1.9.0<1.9.16

maven/org.apache.ant:ant>=1.10.0<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile Engineering Data Management=6.2.1.0

Oracle Agile PLM=9.3.6

and 75 more

● CVE-2021-36373

Apache Ant is vulnerable to a denial of service, caused by an out-of-memory error when large amounts of memory are allocated. By persuading a victim to open a specially-crafted TAR archive, a remote a...

redhat/Apache Ant<1.9.16

redhat/Ant<1.10.11

Apache Ant>=1.9.0<1.9.16

Apache Ant>=1.10.0<1.10.11

Oracle Agile PLM=9.3.6

Oracle Banking Trade Finance=14.5

and 69 more

● CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulner...

Apache Batik<=1.13

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Oracle Banking Apis=18.3

Oracle Banking Apis=19.1

Oracle Banking Apis=19.2

and 38 more

● CVE-2019-17566

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vul...

maven/org.apache.xmlgraphics:batik<1.13

Apache Batik<1.13

Oracle API Gateway=11.1.2.4.0

Oracle Business Intelligence=5.5.0.0.0

Oracle Business Intelligence=5.9.0.0.0

Oracle Business Intelligence=12.2.1.3.0

and 26 more

● CVE-2020-1945

Apache Ant could allow a remote attacker to bypass security restrictions, caused by the use of an insecure temporary directory to store source files. By sending a specially-crafted request, an attacke...

redhat/jenkins<0:2.263.3.1612433584-1.el7

redhat/conmon<2:2.0.21-1.rhaos4.5.el8

redhat/jenkins<0:2.263.3.1612434332-1.el7

redhat/machine-config-daemon<0:4.5.0-202102050524.p0.git.2594.ff3b8c0.el8

redhat/openshift<0:4.5.0-202102050524.p0.git.0.9229406.el7

redhat/openshift-ansible<0:4.5.0-202102031005.p0.git.0.c6839a2.el7

and 128 more

● CVE-2020-5397

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) e...

maven/org.springframework:spring-webflux>=5.2.0<5.2.3

maven/org.springframework:spring-webmvc>=5.2.0<5.2.3

VMware Spring Framework>=5.2.0<5.2.3

Oracle Application Testing Suite=13.3.0.1

Oracle Communications Brm - Elastic Charging Engine=11.3

Oracle Communications Brm - Elastic Charging Engine=12.0

and 48 more

● CVE-2020-5398

A flaw was found in springframework in versions prior to 5.0.16, 5.1.13, and 5.2.3. A reflected file download (RFD) attack is possible when a "Content-Disposition" header is set in response to where t...

IBM Data Risk Manager<=2.0.6

redhat/springframework<5.2.3

redhat/springframework<5.1.13

redhat/springframework<5.0.16

maven/org.springframework:spring-webflux>=5.0.0.RELEASE<5.0.16.RELEASE

maven/org.springframework:spring-webflux>=5.1.0.RELEASE<5.1.13.RELEASE

and 67 more

● CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Jav...

redhat/apache-commons-beanutils<0:1.8.3-15.el7_7

redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea

redhat/eap7-apache-commons-beanutils<0:1.9.4-1.redhat_00002.1.el6ea

redhat/eap7-glassfish-el<0:3.0.1-4.b08_redhat_00003.1.el6ea

redhat/eap7-glassfish-jaxb<0:2.3.3-4.b02_redhat_00001.1.el6ea

redhat/eap7-glassfish-jsf<0:2.3.5-7.SP3_redhat_00005.1.el6ea

and 486 more

● CVE-2019-13990

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

redhat/rhvm-dependencies<0:4.4.0-1.el8e

IBM Data Risk Manager<=2.0.6

maven/org.quartz-scheduler:quartz<2.3.2

redhat/quartz<2.3.2

Softwareag Quartz<2.3.2

Oracle Apache Batik Mapviewer=12.2.0.1

and 178 more

● CVE-2019-2558

Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: Infrastructure). Supported versions that are affected are 13.4, 14.0 and 14.1. Easily exploit...

Oracle Retail Point-of-Service=13.4

Oracle Retail Point-of-Service=14.0

Oracle Retail Point-of-Service=14.1

● CVE-2019-11358

A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted J...

redhat/ansible-tower<0:3.5.2-1.el7a

redhat/cfme<0:5.10.9.1-1.el7cf

redhat/cfme-amazon-smartstate<0:5.10.9.1-1.el7cf

redhat/cfme-appliance<0:5.10.9.1-1.el7cf

redhat/cfme-gemset<0:5.10.9.1-1.el7cf

redhat/ovirt-ansible-hosted-engine-setup<0:1.0.23-1.el7e

and 267 more

● CVE-2018-8013

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of ...

ubuntu/batik<1.10-1

ubuntu/batik<1.7.ubuntu-8ubuntu2.14.04.3

>=1.0<1.10

=7.0

=8.0

=9.0

and 80 more

Latest oracle retail point-of-service Vulnerabilities

Company

Resources

Contact