RX
Product
Retail Xstore Point OF Service
On CISA KEVExploited in the wild
125
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 26High 65Medium 31Low 3
Watch
Add Retail Xstore Point OF Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-39154 | 8.5 | Aug 23 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2017-10214 | 8.2 | Aug 8 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office) Affected: 6.0.10; 6.0.11; 6.5.4; 6.5.10; 6.5.11; 7.0; +16 more |
| CVE-2020-36182 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36180 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36179 | 8.1 | Jan 7 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36184 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36181 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36183 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36185 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36186 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36187 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36188 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-36189 | 8.1 | Jan 6 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-35728 | 8.1 | Dec 27 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-35490 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-35491 | 8.1 | Dec 17 | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-8174 | 8.1 | Jul 24 | napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0 Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2020-11620 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2020-11619 | 8.1 | Apr 7 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2018-2840 | 7.6 | Apr 19 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office) Affected: 6.5.11; 7.0.6; 7.1.6; 15.0.1; 16.0.2 |
| CVE-2021-43859 | 7.5 | Feb 1 | XStream is an open source java library to serialize objects to XML and back again Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-21348 | 7.5 | Mar 22 | XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21341 | 7.5 | Mar 22 | XStream can cause a Denial of Service Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2021-21343 | 7.5 | Mar 22 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2020-8277 | 7.5 | Nov 19 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2020-11979 | 7.5 | Oct 1 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them Affected: 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2019-17359 | 7.5 | Oct 8 | The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data Affected: 18.0.1 |
| CVE-2019-12402 | 7.5 | Aug 30 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 7.1 |
| CVE-2019-14439 | 7.5 | Jul 30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2 Affected: 7.1; 15.0; 16.0; 17.0; 18.0 |
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 7.1 |
| CVE-2019-5427 | 7.5 | Apr 22 | c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading… Affected: 15.0; 16.0; 17.0; 18.0; 19.0 |
| CVE-2019-0217 | 7.5 | Apr 8 | In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate… Affected: 7.0; 7.1 |
| CVE-2019-0190 | 7.5 | Jan 30 | A bug exists in the way mod_ssl handled client renegotiations Affected: 7.0; 7.1 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 7.1 |
| CVE-2018-11040 | 7.5 | Jun 25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON… Affected: 7.1 |
| CVE-2018-1000180 | 7.5 | Jun 5 | Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in… Affected: 7.0; 7.1 |
| CVE-2017-9735 | 7.5 | Jun 16 | Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.1; 15.0; 16.0; 17.0; 18.0 |
| CVE-2019-10097 | 7.2 | Sep 26 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… Affected: 7.1 |
| CVE-2021-44832 | 6.6 | Dec 28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses… Affected: 17.0.4; 18.0.3; 19.0.2; 20.0.1; 21.0.1 |
| CVE-2018-3126 | 6.6 | Oct 17 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xenvironment) Affected: 15.0.2; 16.0.4; 17.0.2 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2019-3738 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2019-3740 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2019-3739 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2017-10427 | 6.5 | Oct 19 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale) Affected: 6.0.11; 6.5.11; 7.0.6; 7.1.6; 15.0.1 |
| CVE-2017-10183 | 6.5 | Aug 8 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale) Affected: 6.0.10; 6.0.11; 6.5.4; 6.5.10; 6.5.11; 7.0; +16 more |
| CVE-2021-39140 | 6.3 | Aug 23 | XStream can cause a Denial of Service Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |