Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

oracle retail returns management 14.0 vulnerabilities and exploits

(subscribe to this query)
6.1
CVSSv3

CVE-2021-35043

OWASP AntiSamy prior to 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.
Antisamy Project AntisamyOracle Retail Back Office 14.0Oracle Retail Back Office 14.1Oracle Retail Central Office 14.0Oracle Retail Central Office 14.1Oracle Retail Returns Management 14.0Oracle Retail Returns Management 14.1Oracle Banking Enterprise Default Management 2.6.2Oracle Banking Enterprise Default Management 2.7.0Oracle Banking Enterprise Default Management 2.7.1Oracle Banking Enterprise Default Management 2.10.0Oracle Banking Enterprise Default Management 2.12.0
5.9
CVSSv3

CVE-2018-1271

Spring Framework, versions 5.0 before 5.0.5 and versions 4.3 before 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to th...
Vmware Spring FrameworkOracle Application Testing Suite 12.5.0.3Oracle Application Testing Suite 13.1.0.1Oracle Application Testing Suite 13.2.0.1Oracle Application Testing Suite 13.3.0.1Oracle Big Data Discovery 1.6.0Oracle Communications Converged Application ServerOracle Communications Diameter Signaling RouterOracle Communications Performance Intelligence CenterOracle Communications Policy Management 12.5.0Oracle Communications Services GatekeeperOracle Enterprise Manager Ops Center 12.2.2
6.3
CVSSv3

CVE-2020-1945

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory bac...
Apache AntCanonical Ubuntu Linux 19.10Fedoraproject Fedora 31Fedoraproject Fedora 32Opensuse Leap 15.2Oracle Agile Engineering Data Management 6.2.1.0Oracle Banking Enterprise CollectionsOracle Banking Liquidity ManagementOracle Banking PlatformOracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 12.2.1.4.0Oracle Category Management Planning & Optimization 15.0.3
8.8
CVSSv3

CVE-2018-1258

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Pivotal Software Spring SecurityVmware Spring Framework 5.0.5Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.4Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Application Testing Suite 10.1Oracle Application Testing Suite 12.5.0.3Oracle Application Testing Suite 13.1.0.1Oracle Application Testing Suite 13.2.0.1Oracle Application Testing Suite 13.3.0.1Oracle Big Data Discovery 1.6.0
8.1
CVSSv3

CVE-2017-12617

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a...
Apache TomcatCanonical Ubuntu Linux 12.04Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 18.04Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.4Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Communications Instant Messaging Server 10.0.1Oracle Endeca Information Discovery Integrator 3.1.0Oracle Endeca Information Discovery Integrator 3.2.0
9.8
CVSSv3

CVE-2018-8013

In Apache Batik 1.x prior to 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deser...
Apache BatikDebian Debian Linux 7.0Debian Debian Linux 8.0Debian Debian Linux 9.0Canonical Ubuntu Linux 14.04Oracle Business Intelligence 11.1.1.7.0Oracle Business Intelligence 11.1.1.9.0Oracle Business Intelligence 12.2.1.3.0Oracle Business Intelligence 12.2.1.4.0Oracle Communications Diameter Signaling RouterOracle Communications Metasolv Solution 6.3.0Oracle Communications Webrtc Session Controller
6.5
CVSSv3

CVE-2020-5421

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Vmware Spring FrameworkOracle Commerce Guided Search 11.3.2Oracle Communications Brm 11.3.0.9Oracle Communications Brm 12.0.0.3Oracle Communications Design Studio 7.3.4Oracle Communications Design Studio 7.3.5Oracle Communications Design Studio 7.4.0Oracle Communications Session Report ManagerOracle Communications Unified Inventory Management 7.3.4Oracle Communications Unified Inventory Management 7.3.5Oracle Endeca Information Discovery Integrator 3.2.0Oracle Enterprise Data Quality 12.2.1.3.0
7.3
CVSSv3

CVE-2019-10086

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an malicious user to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of th...
Apache Commons BeanutilsApache Nifi 1.14.0Apache Nifi 1.15.0Debian Debian Linux 8.0Opensuse Leap 15.0Opensuse Leap 15.1Fedoraproject Fedora 30Fedoraproject Fedora 31Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Eus 7.7Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Server Aus 7.7
7.5
CVSSv3

CVE-2018-15756

Spring Framework, version 5.1, versions 5.0.x before 5.0.10, versions 4.3.x before 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annota...
Vmware Spring FrameworkVmware Spring Framework 5.1.0Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.4Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Communications Brm - Elastic Charging Engine 11.3Oracle Communications Brm - Elastic Charging Engine 12.0Oracle Communications Converged Application Server - Service Controller 6.0Oracle Communications Converged Application Server - Service Controller 6.1Oracle Communications Diameter Signaling Router 8.0.0Oracle Communications Diameter Signaling Router 8.1
6.1
CVSSv3

CVE-2019-11358

jQuery prior to 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Jquery JqueryDebian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Drupal DrupalBackdropcms BackdropFedoraproject Fedora 28Fedoraproject Fedora 29Fedoraproject Fedora 30Opensuse Backports Sle 15.0Opensuse Leap 15.1Netapp Oncommand System Manager
Preferred Score:
CVSSv3
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2024-13837openanolisshopwardenmobatekCVE-2024-13582CVE-2025-25223CVE-2025-24200client sideCVE-2024-40591CVE-2024-13627type confusionCSRFsoftdiscover
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook