RX
Product
Retail Xstore Point OF Service
On CISA KEVExploited in the wild
125
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 26High 65Medium 31Low 3
Watch
Add Retail Xstore Point OF Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22965 In wildKEV | 9.8 | Apr 1 | Spring Framework JDK 9+ Remote Code Execution Vulnerability Affected: 20.0.1; 21.0.0 |
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: 20.0.1; 21.0.0 |
| CVE-2021-39144 In wildKEV | 8.5 | Aug 23 | XStream is vulnerable to a Remote Command Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 6.0.11; 7.0.6; 7.1.6; 15.0.1 |
| CVE-2019-0211 In wildKEV | 7.8 | Apr 8 | Apache HTTP Server Privilege Escalation Vulnerability Affected: 7.0; 7.1 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21350 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21344 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21346 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21347 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-10683 | 9.8 | May 1 | dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks Affected: 15.0.4; 16.0.6; 17.0.4; 18.0.3 |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-9547 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-9548 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2019-0219 | 9.8 | Jan 14 | A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2019-20330 | 9.8 | Jan 3 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.1; 15.0; 16.0; 17.0; 18.0 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.1; 15.0; 16.0; 17.0; 18.0 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 7.1; 15.0; 16.0; 17.0; 18.0 |
| CVE-2019-13990 | 9.8 | Jul 26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2019-10173 | 9.8 | Jul 23 | It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw Affected: 17.0 |
| CVE-2019-0228 | 9.8 | Apr 17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF Affected: 16.0.6; 17.0; 18.0.3 |
| CVE-2018-1000613 | 9.8 | Jul 9 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select… Affected: 7.0; 7.1 |
| CVE-2017-7658 | 9.8 | Jun 26 | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2017-7657 | 9.8 | Jun 26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2018-1270 | 9.8 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a… Affected: 7.1 |
| CVE-2021-21351 | 9.1 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21342 | 9.1 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2019-10082 | 9.1 | Sep 26 | In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown Affected: 7.1 |
| CVE-2021-39139 | 8.8 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-29505 | 8.8 | May 28 | XStream is vulnerable to a Remote Command Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2020-26217 | 8.8 | Nov 16 | Remote Code Execution in XStream Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-11113 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-11112 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-11111 | 8.8 | Mar 31 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-10969 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-10968 | 8.8 | Mar 26 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-10673 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-10672 | 8.8 | Mar 18 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2018-1258 | 8.8 | May 11 | Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security Affected: 17.0 |
| CVE-2021-21349 | 8.6 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-39150 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39152 | 8.5 | Aug 23 | A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39149 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39148 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39147 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39146 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.2; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39145 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39141 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-39151 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.2; 18.0.3; 19.0.2; 20.0.1 |