RX
Product
Retail Xstore Point OF Service
On CISA KEVExploited in the wild
125
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 26High 65Medium 31Low 3
Watch
Add Retail Xstore Point OF Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44832 | 6.6 | Dec 28 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses… Affected: 17.0.4; 18.0.3; 19.0.2; 20.0.1; 21.0.1 |
| CVE-2018-3126 | 6.6 | Oct 17 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Xenvironment) Affected: 15.0.2; 16.0.4; 17.0.2 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2019-3738 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2019-3740 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2019-3739 | 6.5 | Sep 18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation Affected: 15.0.3; 16.0.5; 17.0.3; 18.0.2; 19.0.1 |
| CVE-2017-10427 | 6.5 | Oct 19 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale) Affected: 6.0.11; 6.5.11; 7.0.6; 7.1.6; 15.0.1 |
| CVE-2017-10183 | 6.5 | Aug 8 | Vulnerability in the Oracle Retail Xstore Point of Service component of Oracle Retail Applications (subcomponent: Point of Sale) Affected: 6.0.10; 6.0.11; 6.5.4; 6.5.10; 6.5.11; 7.0; +16 more |
| CVE-2021-39140 | 6.3 | Aug 23 | XStream can cause a Denial of Service Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2020-1945 | 6.3 | May 14 | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak… Affected: 15.0.4; 16.0.6; 17.0.4; 18.0.3; 19.0.2 |
| CVE-2017-15707 | 6.2 | Dec 1 | In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially… Affected: 6.5.11; 7.0.6; 7.1.6; 15.0.1; 16.0.2 |
| CVE-2019-10241 | 6.1 | Apr 22 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 7.1 |
| CVE-2018-11763 | 5.9 | Sep 25 | In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout… Affected: 7.0; 7.1 |
| CVE-2018-11039 | 5.9 | Jun 25 | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any… Affected: 7.1 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2018-1271 | 5.9 | Apr 6 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources… Affected: 7.1 |
| CVE-2021-36374 | 5.5 | Jul 14 | When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-36373 | 5.5 | Jul 14 | When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small… Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-27906 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2021-27807 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 16.0.6; 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2018-11797 | 5.5 | Oct 5 | In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree Affected: 17.0 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 7.1; 15.0; 16.0; 17.0 |
| CVE-2018-17189 | 5.3 | Jan 30 | In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server… Affected: 7.0; 7.1 |
| CVE-2018-12536 | 5.3 | Jun 27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and… Affected: 7.1; 15.0; 16.0.0; 17.0 |
| CVE-2018-1199 | 5.3 | Mar 16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider… Affected: 7.1 |
| CVE-2021-29425 | 4.8 | Apr 13 | Possible limited path traversal vulnerabily in Apache Commons IO Affected: 17.0.4; 18.0.3; 19.0.2; 20.0.1 |
| CVE-2016-3429 | 4.5 | Apr 21 | Unspecified vulnerability in the Oracle Retail Xstore Point of Service component in Oracle Retail Applications 5.0, 5.5, 6.0, 6.5, 7.0, and 7.1 allows remote authenticated users… Affected: 5.0; 5.5; 6.0; 6.5; 7.0; 7.1 |
| CVE-2026-21954 | 4.3 | Jul 21 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mobile) Affected: 21.0.3 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 7.0; 7.1 |
Showing 31