RC
Product
Retail Customer Management And Segmentation Foundation
On CISA KEVExploited in the wild
55
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 21Medium 18Low 5
Watch
Add Retail Customer Management And Segmentation Foundation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 17.0; 18.0; 19.0 |
| CVE-2020-5413 | 9.8 | Jul 31 | Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization Affected: 16.0 through 19.0 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-2953 | 9.8 | Apr 15 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promotions) Affected: 18.0 |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 17.0 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 17.0 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 17.0 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 17.0 |
| CVE-2018-11307 | 9.8 | Jul 9 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5 Affected: 17.0 |
| CVE-2019-3772 | 9.8 | Jan 18 | Spring Integration XML External Entity Injection (XXE) Affected: 16.0; 17.0; 18.0 |
| CVE-2018-14718 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic… Affected: 17.0 |
| CVE-2018-3315 | 8.2 | Jul 23 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Customer) Affected: 16.0; 17.0 |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0 through 19.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 16.0 through 19.0 |
| CVE-2018-3316 | 7.6 | Jul 23 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Segment) Affected: 16.0; 17.0 |
| CVE-2021-37714 | 7.5 | Aug 18 | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions Affected: 17.0 through 19.0 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 17.0 |
| CVE-2020-25638 | 7.4 | Dec 2 | A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final Affected: 19.0 |
| CVE-2021-23337 | 7.2 | Feb 15 | Command Injection Affected: 19.0 |
| CVE-2020-14709 | 7.1 | Jul 15 | Vulnerability in the Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Card) Affected: 16.0; 17.0; 18.0 |
| CVE-2021-30129 | 6.5 | Jul 12 | A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error Affected: 18.0; 19.0 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 16.0 through 19.0 |
| CVE-2020-2650 | 6.5 | Jan 15 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Promotions) Affected: 16.0 |
| CVE-2018-3053 | 6.4 | Jul 18 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Internal Operations) Affected: 16.0.1; 16.0.2; 17.0.1 |
| CVE-2021-2057 | 6.3 | Jan 20 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Internal Operations) Affected: 19.0 |
| CVE-2020-2648 | 6.2 | Jan 15 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Internal Operations) Affected: 16.0 |
| CVE-2020-11022 | 6.1 | Apr 29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e Affected: 19.0; 19.0 |
| CVE-2019-2884 | 5.9 | Oct 16 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment) Affected: 17.0 |
| CVE-2021-31812 | 5.5 | Jun 12 | In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 18.1 |
| CVE-2021-31811 | 5.5 | Jun 12 | In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 18.1 |
| CVE-2021-27906 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 19.0 |
| CVE-2021-27807 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 19.0 |
| CVE-2020-14710 | 5.4 | Jul 15 | Vulnerability in the Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Security) Affected: 16.0; 17.0; 18.0 |
| CVE-2020-28500 | 5.3 | Feb 15 | Regular Expression Denial of Service (ReDoS) Affected: 19.0 |
| CVE-2020-13956 | 5.3 | Dec 2 | Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick… Affected: 16.0 through 19.0 |
| CVE-2020-2567 | 4.8 | Jan 15 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Security) Affected: 18.0 |
| CVE-2019-2883 | 4.6 | Oct 16 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment) Affected: 17.0 |
| CVE-2020-14708 | 4.3 | Jul 15 | Vulnerability in the Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment) Affected: 16.0; 17.0; 18.0 |