[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZciRQ51RdsQeFM3jvEzHuffAw6pcAX1veG9BQvxX8-w":3,"g5a-ex:oracle\u002Fcommerce_guided_search@*":143,"g5a-family:oracle\u002Fcommerce_guided_search":153},{"success":4,"data":5},true,{"product":6,"versions":44,"topVulnerabilitiesByEpss":57,"kevVulnerabilities":111,"seoMetadata":121,"meta":140},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":43},"oracle","commerce_guided_search",12,52,2,"2023-10-17",[14,18,20,22,24,27,30,33,35,37,39,41],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"11.0",0,false,{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},"11.1",{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},"11.2",{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},"11.3.1",{"version":25,"cve_count":26,"kev_count":16,"has_kev":17},"11.3.1.5",3,{"version":28,"cve_count":29,"kev_count":11,"has_kev":4},"11.3.2",47,{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},"6.2.2",1,{"version":34,"cve_count":32,"kev_count":16,"has_kev":17},"6.3.0",{"version":36,"cve_count":32,"kev_count":16,"has_kev":17},"6.4.1.2",{"version":38,"cve_count":32,"kev_count":16,"has_kev":17},"6.5.0",{"version":40,"cve_count":32,"kev_count":16,"has_kev":17},"6.5.1",{"version":42,"cve_count":32,"kev_count":16,"has_kev":17},"6.5.2","Commerce Guided Search by Oracle is a technology product with 12 tracked versions and 52 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[45,46,47,48,49,50,51,52,53,54,55,56],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":16,"kev_count":16,"has_kev":17},{"version":21,"cve_count":16,"kev_count":16,"has_kev":17},{"version":23,"cve_count":16,"kev_count":16,"has_kev":17},{"version":25,"cve_count":26,"kev_count":16,"has_kev":17},{"version":28,"cve_count":29,"kev_count":11,"has_kev":4},{"version":31,"cve_count":32,"kev_count":16,"has_kev":17},{"version":34,"cve_count":32,"kev_count":16,"has_kev":17},{"version":36,"cve_count":32,"kev_count":16,"has_kev":17},{"version":38,"cve_count":32,"kev_count":16,"has_kev":17},{"version":40,"cve_count":32,"kev_count":16,"has_kev":17},{"version":42,"cve_count":32,"kev_count":16,"has_kev":17},[58,66,73,79,85,89,92,98,103,107],{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":63,"severity":64,"isKev":4,"epssScore":65},"CVE-2022-22947","In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.","2022-03-03",10,"v3.1","Critical",0.98253,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":63,"severity":71,"isKev":4,"epssScore":72},"CVE-2021-39144","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","2021-08-23",8.5,"High",0.98124,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":78},"CVE-2020-13935","The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","2020-07-14",7.5,0.86608,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":83,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":84},"CVE-2021-3450","The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).","2021-03-25",7.4,0.18339,{"cveId":86,"description":87,"publishedDate":69,"cvssScore":70,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":88},"CVE-2021-39141","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",0.16118,{"cveId":90,"description":87,"publishedDate":69,"cvssScore":70,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":91},"CVE-2021-39146",0.143,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":63,"severity":64,"isKev":17,"epssScore":97},"CVE-2019-12419","Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.","2019-11-06",9.8,0.13836,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":77,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":102},"CVE-2021-36090","When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.","2021-07-13",0.12945,{"cveId":104,"description":105,"publishedDate":101,"cvssScore":77,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":106},"CVE-2021-35516","When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.",0.12365,{"cveId":108,"description":109,"publishedDate":101,"cvssScore":77,"cvssVersion":63,"severity":71,"isKev":17,"epssScore":110},"CVE-2021-35515","When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.",0.11567,[112,117],{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"severity":71,"isKev":4,"epssScore":72,"cisaVulnName":113,"cisaDateAdded":114,"cisaShortDescription":115,"cisaRequiredAction":116},"XStream Remote Code Execution Vulnerability","2023-03-10","XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","Apply updates per vendor instructions.",{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"severity":64,"isKev":4,"epssScore":65,"cisaVulnName":118,"cisaDateAdded":119,"cisaShortDescription":120,"cisaRequiredAction":116},"VMware Spring Cloud Gateway Code Injection Vulnerability","2022-05-16","Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.",{"title":122,"metaDescription":123,"keywords":124,"structuredData":125},"Commerce Guided Search by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Commerce Guided Search by Oracle covering 12 versions with 52 tracked vulnerabilities including 1 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Commerce Guided Search vulnerabilities, Commerce Guided Search security, Commerce Guided Search CVE, Oracle Commerce Guided Search, Commerce Guided Search threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Commerce Guided Search KEV, Commerce Guided Search exploited vulnerabilities",{"@context":126,"@type":127,"name":128,"description":123,"url":129,"manufacturer":130,"applicationCategory":134,"softwareVersion":135,"mainEntity":136},"https:\u002F\u002Fschema.org","SoftwareApplication","Commerce Guided Search","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommerce_guided_search",{"@type":131,"name":132,"url":133},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","12 versions tracked",{"@type":137,"name":138,"description":139,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Commerce Guided Search Security Vulnerabilities","Security vulnerabilities affecting Commerce Guided Search by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":141,"apiVersion":142},"2026-10-17T12:43:16.212Z","3.0",{"rows":144,"total":11,"capped":17,"failed":16},[145,149],{"cveId":67,"name":113,"severity":71,"cvss":70,"added":114,"epss":72,"published":146,"ranges":147,"checked":4,"hits":148,"covers":17},"2021-08-23T18:15:12.087",[28],[],{"cveId":59,"name":118,"severity":64,"cvss":62,"added":119,"epss":65,"published":150,"ranges":151,"checked":4,"hits":152,"covers":17},"2022-03-03T22:15:08.673",[28],[],[154],{"product":155,"cves":11},"commerce_guided_search_and_experience_manager"]