RO
Product
Retail Order Broker
On CISA KEVExploited in the wild
36
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 16Medium 13Low 0
Watch
Add Retail Order Broker to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 5.0; 5.1; 5.2; 15.0; 16.0 |
| CVE-2020-13936 | 8.8 | Mar 10 | An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet… Affected: 16.0 |
| CVE-2020-9410 | 8.8 | May 20 | The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO… Affected: 15.0; 16.0 |
| CVE-2020-11987 | 8.2 | Feb 24 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel Affected: 15.0; 16.0 |
| CVE-2021-22118 | 7.8 | May 27 | In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary… Affected: 16.0 |
| CVE-2016-3565 | 7.6 | Jul 21 | Unspecified vulnerability in the Oracle Retail Order Broker component in Oracle Retail Applications 5.1 and 5.2 allows remote authenticated users to affect confidentiality,… Affected: 5.1; 5.2 |
| CVE-2022-25647 | 7.5 | May 1 | The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS… Affected: 18.0; 19.1 |
| CVE-2019-17566 | 7.5 | Nov 12 | Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes Affected: 15.0; 16.0 |
| CVE-2020-5398 | 7.5 | Jan 16 | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application Affected: 15.0; 16.0 |
| CVE-2019-12423 | 7.5 | Jan 16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens… Affected: 15.0 |
| CVE-2019-17563 | 7.5 | Dec 23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session… Affected: 15.0 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 15.0; 16.0; 18.0 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 5.1; 5.2; 15.0; 16.0 |
| CVE-2018-8034 | 7.5 | Aug 1 | The host name verification when using TLS with the WebSocket client was missing Affected: 5.1; 5.2; 15.0 |
| CVE-2018-1272 | 7.5 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests Affected: 5.1; 5.2; 15.0; 16.0 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 15.0 |
Showing 16