Retail Xstore Point OF Service vulnerabilities | LiveThreat CVE Feed

Product

Retail Xstore Point OF Service

by Oracle · last CVE Jul 21, 2026

On CISA KEVExploited in the wild

125

CVEs

On KEV

9.9

Max CVSS

New 30D

Vulnerabilities125 In the news0 Timeline

Severity mix

Critical 26High 65Medium 31Low 3

Severity

All severities125 Critical26 High65 Medium31 Low3

Exploitation

On CISA KEV5 Exploited in the wild5

Watch

Add Retail Xstore Point OF Service to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-39144 In wildKEV	8.5	98%	Aug 23	XStream is vulnerable to a Remote Command Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2017-12617 In wildKEV	8.1	100%	Oct 3	When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 6.0.11; 7.0.6; 7.1.6; 15.0.1
CVE-2019-0211 In wildKEV	7.8	65%	Apr 8	Apache HTTP Server Privilege Escalation Vulnerability Affected: 7.0; 7.1
CVE-2021-39139	8.8	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-29505	8.8	77%	May 28	XStream is vulnerable to a Remote Command Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2020-26217	8.8	83%	Nov 16	Remote Code Execution in XStream Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-11113	8.8	6%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-11112	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-11111	8.8	4%	Mar 31	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms,… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-10969	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-10968	8.8	4%	Mar 26	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-10673	8.8	8%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-10672	8.8	3%	Mar 18	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2018-1258	8.8	2%	May 11	Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security Affected: 17.0
CVE-2021-21349	8.6	47%	Mar 22	A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2021-39150	8.5	3%	Aug 23	A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39152	8.5	11%	Aug 23	A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39149	8.5	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39148	8.5	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39147	8.5	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39146	8.5	14%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.2; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39145	8.5	4%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39141	8.5	16%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39151	8.5	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.2; 18.0.3; 19.0.2; 20.0.1
CVE-2021-39154	8.5	5%	Aug 23	XStream is vulnerable to an Arbitrary Code Execution attack Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2017-10214	8.2	2%	Aug 8	Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office) Affected: 6.0.10; 6.0.11; 6.5.4; 6.5.10; 6.5.11; 7.0; +16 more
CVE-2020-36182	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36180	8.1	4%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36179	8.1	17%	Jan 7	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36184	8.1	8%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36181	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36183	8.1	5%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36185	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36186	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36187	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36188	8.1	9%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-36189	8.1	4%	Jan 6	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-35728	8.1	13%	Dec 27	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-35490	8.1	6%	Dec 17	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-35491	8.1	8%	Dec 17	FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-8174	8.1	8%	Jul 24	napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0 Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2020-11620	8.1	6%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2020-11619	8.1	4%	Apr 7	FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 15.0; 16.0; 17.0; 18.0; 19.0
CVE-2018-2840	7.6	1%	Apr 19	Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xstore Office) Affected: 6.5.11; 7.0.6; 7.1.6; 15.0.1; 16.0.2
CVE-2021-43859	7.5	8%	Feb 1	XStream is an open source java library to serialize objects to XML and back again Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2021-21348	7.5	14%	Mar 22	XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos) Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2021-21341	7.5	78%	Mar 22	XStream can cause a Denial of Service Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2021-21343	7.5	47%	Mar 22	XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2
CVE-2020-25649	7.5	18%	Dec 3	A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1
CVE-2020-8277	7.5	54%	Nov 19	A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2