Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

commerce platform vulnerabilities and exploits

(subscribe to this query)
9.8
CVSSv3
CVE-2020-2555
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with net...
Oracle Webcenter Portal 12.2.1.3.0Oracle Utilities Framework 4.2.0.3.0Oracle Utilities Framework 4.2.0.2.0Oracle Retail Assortment Planning 15.0Oracle Utilities Framework 4.4.0.0.0Oracle Retail Assortment Planning 16.0Oracle Coherence 12.2.1.3.0Oracle Coherence 12.1.3.0.0Oracle Coherence 3.7.1.0Oracle Coherence 12.2.1.4.0Oracle Webcenter Portal 12.2.1.4.0Oracle Rapid Planning 12.1Oracle Rapid Planning 12.2Oracle Utilities FrameworkOracle Utilities Framework 4.4.0.2.0Oracle Communications Diameter Signaling RouterOracle Healthcare Data Repository 7.0.1Oracle Commerce PlatformOracle Commerce Platform 11.0.0Oracle Commerce Platform 11.1.0Oracle Commerce Platform 11.2.0
NA
CVE-2015-0495
Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote malicious users to affect confidentiality, integrity, and availability via unknown vectors related to Workbench.
Oracle Commerce Guided Search And Experience Manager 11.0Oracle Commerce Guided Search And Experience Manager 3.0Oracle Commerce Guided Search And Experience Manager 3.1.0Oracle Commerce Guided Search And Experience Manager 3.1.1Oracle Commerce Guided Search And Experience Manager 3.1.2Oracle Commerce Guided Search And Experience Manager 11.1
9.8
CVSSv3
CVE-2019-12419
Apache CXF prior to 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the suppli...
Apache CxfOracle Flexcube Private Banking 12.1.0Oracle Flexcube Private Banking 12.0.0Oracle Retail Order Broker 15.0Oracle Enterprise Manager Base Platform 13.2.1.0Oracle Commerce Guided Search 11.3.2
5.4
CVSSv3
CVE-2023-42627
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 up to and including 7.4.3.91, and Liferay DXP 7.3 update 33 and previous versions, and 7.4 before update 92 allow remote malicious users to inject arbitrary web script or HTM...
Liferay Digital Experience Platform 7.3Liferay Digital Experience Platform 7.4Liferay Liferay Portal
5.4
CVSSv3
CVE-2022-24728
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing ...
Ckeditor CkeditorDrupal DrupalOracle Peoplesoft Enterprise Peopletools 8.58Oracle Peoplesoft Enterprise Peopletools 8.59Oracle Commerce Merchandising 11.3.2Oracle Financial Services Trade-based Anti Money Laundering 8.0.7Oracle Financial Services Trade-based Anti Money Laundering 8.0.8Fedoraproject Fedora 36Oracle Financial Services Analytical Applications Infrastructure 8.1.2.0Oracle Financial Services Analytical Applications Infrastructure 8.1.1.0Oracle Application ExpressOracle Financial Services Analytical Applications Infrastructure 8.1.2.1Oracle Financial Services Behavior Detection PlatformOracle Financial Services Analytical Applications InfrastructureOracle Financial Services Behavior Detection Platform 8.0.8.0Oracle Financial Services Behavior Detection Platform 8.0.7.0Fedoraproject Fedora 37
7.5
CVSSv3
CVE-2022-24729
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop r...
Ckeditor CkeditorDrupal DrupalOracle Peoplesoft Enterprise Peopletools 8.58Oracle Peoplesoft Enterprise Peopletools 8.59Oracle Commerce Merchandising 11.3.2Oracle Financial Services Trade-based Anti Money Laundering 8.0.7Oracle Financial Services Trade-based Anti Money Laundering 8.0.8Fedoraproject Fedora 36Oracle Financial Services Analytical Applications Infrastructure 8.1.2.0Oracle Financial Services Analytical Applications Infrastructure 8.1.1.0Oracle Application ExpressOracle Financial Services Analytical Applications Infrastructure 8.1.2.1Oracle Financial Services Behavior Detection PlatformOracle Financial Services Analytical Applications InfrastructureOracle Financial Services Behavior Detection Platform 8.0.8.0Oracle Financial Services Behavior Detection Platform 8.0.7.0Fedoraproject Fedora 37
7.5
CVSSv3
CVE-2020-25649
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Fasterxml Jackson-databindNetapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Fedoraproject Fedora 32Quarkus QuarkusApache IotdbOracle Webcenter Portal 12.2.1.3.0Oracle Banking Platform 2.6.2Oracle Utilities Framework 4.3.0.5.0Oracle Utilities Framework 4.3.0.6.0Oracle Utilities Framework 4.4.0.0.0Oracle Agile Plm 9.3.6Oracle Coherence 12.2.1.4.0Oracle Webcenter Portal 12.2.1.4.0Oracle Sd-wan Edge 9.0Oracle Coherence 14.1.1.0.0Oracle Utilities Framework 4.4.0.2.0Oracle Communications Billing And Revenue Management 12.0.0.3.0Oracle Communications Billing And Revenue Management 7.5.0.23.0Oracle Communications Services Gatekeeper 7.0Oracle Banking Platform 2.7.0
8.1
CVSSv3
CVE-2020-36189
FasterXML jackson-databind 2.x prior to 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Fasterxml Jackson-databindNetapp Cloud Backup -Netapp Service Level Manager -Debian Debian Linux 9.0Oracle Webcenter Portal 12.2.1.3.0Oracle Application Testing Suite 13.3.0.1Oracle Banking Platform 2.6.2Oracle Primavera Unifier 18.8Oracle Primavera UnifierOracle Agile Plm 9.3.6Oracle Primavera Unifier 19.12Oracle Webcenter Portal 12.2.1.4.0Oracle Communications Billing And Revenue Management 12.0.0.3.0Oracle Communications Billing And Revenue Management 7.5.0.23.0Oracle Communications Services Gatekeeper 7.0Oracle Retail Merchandising System 15.0.3Oracle Banking Platform 2.7.0Oracle Banking Platform 2.7.1Oracle Banking Platform 2.9.0Oracle Communications Evolved Communications Application Server 7.1Oracle Goldengate Application Adapters 19.1.0.0.0Oracle Retail Service Backbone 16.0.3
7.5
CVSSv3
CVE-2020-13935
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lea...
Apache Tomcat 9.0.0Apache Tomcat 10.0.0Apache TomcatDebian Debian Linux 9.0Debian Debian Linux 10.0Netapp Oncommand System ManagerOpensuse Leap 15.1Opensuse Leap 15.2Canonical Ubuntu Linux 20.04Canonical Ubuntu Linux 16.04Mcafee Epolicy Orchestrator 5.9.0Mcafee Epolicy Orchestrator 5.9.1Mcafee Epolicy Orchestrator 5.10.0Oracle Managed File Transfer 12.2.1.3.0Oracle Instantis Enterprisetrack 17.1Oracle Instantis Enterprisetrack 17.2Oracle Instantis Enterprisetrack 17.3Oracle Agile Plm 9.3.3Oracle Agile Plm 9.3.5Oracle Agile Plm 9.3.6Oracle Workload Manager 18cOracle Workload Manager 19c
7.5
CVSSv3
CVE-2019-12423
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12)...
Apache CxfOracle Flexcube Private Banking 12.1.0Oracle Flexcube Private Banking 12.0.0Oracle Retail Order Broker 15.0Oracle Communications Diameter Signaling RouterOracle Communications Session Route Manager 8.1.1Oracle Communications Session Route Manager 8.2.0Oracle Communications Session Route Manager 8.2.1Oracle Communications Session Report ManagerOracle Communications Element ManagerOracle Commerce Guided Search 11.3.2
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-47626CVE-2024-3400physicalCVE-2024-31426CVE-2024-22423CVE-2024-22438injectlocal usersCVE-2024-3797
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook