[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG86NbLRbW8ZLi_2rY_mHa4nBWD-RUXWO80enP5qQb5A":3,"g5a-family:oracle\u002Fcommerce_platform":164,"g5a-ex:oracle\u002Fcommerce_platform@*":165},{"success":4,"data":5},true,{"product":6,"versions":58,"topVulnerabilitiesByEpss":77,"kevVulnerabilities":132,"seoMetadata":142,"meta":161},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":57},"oracle","commerce_platform",18,32,2,"2025-04-15",[14,19,21,23,25,27,29,31,33,36,38,40,43,46,49,51,53,55],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"10.0",1,0,false,{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},"10.0.3.5",{"version":22,"cve_count":16,"kev_count":17,"has_kev":18},"10.2",{"version":24,"cve_count":16,"kev_count":17,"has_kev":18},"10.2.0.5",{"version":26,"cve_count":11,"kev_count":17,"has_kev":18},"11.0",{"version":28,"cve_count":11,"kev_count":16,"has_kev":4},"11.0.0",{"version":30,"cve_count":11,"kev_count":17,"has_kev":18},"11.1",{"version":32,"cve_count":11,"kev_count":16,"has_kev":4},"11.1.0",{"version":34,"cve_count":35,"kev_count":16,"has_kev":4},"11.2.0",15,{"version":37,"cve_count":16,"kev_count":17,"has_kev":18},"11.2.0.2",{"version":39,"cve_count":11,"kev_count":17,"has_kev":18},"11.2.0.3",{"version":41,"cve_count":42,"kev_count":17,"has_kev":18},"11.3.0",6,{"version":44,"cve_count":45,"kev_count":17,"has_kev":18},"11.3.1",7,{"version":47,"cve_count":48,"kev_count":16,"has_kev":4},"11.3.2",8,{"version":50,"cve_count":16,"kev_count":17,"has_kev":18},"3.0.2",{"version":52,"cve_count":11,"kev_count":17,"has_kev":18},"3.1.1",{"version":54,"cve_count":11,"kev_count":17,"has_kev":18},"3.1.2",{"version":56,"cve_count":16,"kev_count":17,"has_kev":18},"9.4","Commerce Platform by Oracle is a technology product with 18 tracked versions and 32 known security vulnerabilities including 2 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":16,"kev_count":17,"has_kev":18},{"version":22,"cve_count":16,"kev_count":17,"has_kev":18},{"version":24,"cve_count":16,"kev_count":17,"has_kev":18},{"version":26,"cve_count":11,"kev_count":17,"has_kev":18},{"version":28,"cve_count":11,"kev_count":16,"has_kev":4},{"version":30,"cve_count":11,"kev_count":17,"has_kev":18},{"version":32,"cve_count":11,"kev_count":16,"has_kev":4},{"version":34,"cve_count":35,"kev_count":16,"has_kev":4},{"version":37,"cve_count":16,"kev_count":17,"has_kev":18},{"version":39,"cve_count":11,"kev_count":17,"has_kev":18},{"version":41,"cve_count":42,"kev_count":17,"has_kev":18},{"version":44,"cve_count":45,"kev_count":17,"has_kev":18},{"version":47,"cve_count":48,"kev_count":16,"has_kev":4},{"version":50,"cve_count":16,"kev_count":17,"has_kev":18},{"version":52,"cve_count":11,"kev_count":17,"has_kev":18},{"version":54,"cve_count":11,"kev_count":17,"has_kev":18},{"version":56,"cve_count":16,"kev_count":17,"has_kev":18},[78,86,91,98,104,109,114,118,123,127],{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":83,"severity":84,"isKev":4,"epssScore":85},"CVE-2022-22965","A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","2022-04-01",9.8,"v3.1","Critical",0.99638,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":82,"cvssVersion":83,"severity":84,"isKev":4,"epssScore":90},"CVE-2020-2555","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2020-01-15",0.97116,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":97},"CVE-2020-25649","A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.","2020-12-03",7.5,"High",0.17714,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":102,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":103},"CVE-2020-36179","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.","2021-01-07",8.1,0.17065,{"cveId":105,"description":106,"publishedDate":107,"cvssScore":102,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":108},"CVE-2020-35728","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web\u002Fjavax.servlet.jsp.jstl).","2020-12-27",0.12504,{"cveId":110,"description":111,"publishedDate":112,"cvssScore":102,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":113},"CVE-2020-36188","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.","2021-01-06",0.08787,{"cveId":115,"description":116,"publishedDate":112,"cvssScore":102,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":117},"CVE-2020-36184","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.",0.08356,{"cveId":119,"description":120,"publishedDate":121,"cvssScore":95,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":122},"CVE-2021-40690","All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the \"secureValidation\" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.","2021-09-19",0.07441,{"cveId":124,"description":125,"publishedDate":101,"cvssScore":102,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":126},"CVE-2020-36183","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.",0.04972,{"cveId":128,"description":129,"publishedDate":130,"cvssScore":95,"cvssVersion":83,"severity":96,"isKev":18,"epssScore":131},"CVE-2020-36518","jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.","2022-03-11",0.0486,[133,138],{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"severity":84,"isKev":4,"epssScore":85,"cisaVulnName":134,"cisaDateAdded":135,"cisaShortDescription":136,"cisaRequiredAction":137},"Spring Framework JDK 9+ Remote Code Execution Vulnerability","2022-04-04","Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.","Apply updates per vendor instructions.",{"cveId":87,"description":88,"publishedDate":89,"cvssScore":82,"severity":84,"isKev":4,"epssScore":90,"cisaVulnName":139,"cisaDateAdded":140,"cisaShortDescription":141,"cisaRequiredAction":137},"Oracle Multiple Products Remote Code Execution Vulnerability","2021-11-03","Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).",{"title":143,"metaDescription":144,"keywords":145,"structuredData":146},"Commerce Platform by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Commerce Platform by Oracle covering 18 versions with 32 tracked vulnerabilities including 2 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Commerce Platform vulnerabilities, Commerce Platform security, Commerce Platform CVE, Oracle Commerce Platform, Commerce Platform threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Commerce Platform KEV, Commerce Platform exploited vulnerabilities",{"@context":147,"@type":148,"name":149,"description":144,"url":150,"manufacturer":151,"applicationCategory":155,"softwareVersion":156,"mainEntity":157},"https:\u002F\u002Fschema.org","SoftwareApplication","Commerce Platform","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fcommerce_platform",{"@type":152,"name":153,"url":154},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","18 versions tracked",{"@type":158,"name":159,"description":160,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Commerce Platform Security Vulnerabilities","Security vulnerabilities affecting Commerce Platform by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":162,"apiVersion":163},"2026-10-17T12:49:16.798Z","3.0",[],{"rows":166,"total":11,"capped":18,"failed":17},[167,171],{"cveId":79,"name":134,"severity":84,"cvss":82,"added":135,"epss":85,"published":168,"ranges":169,"checked":4,"hits":170,"covers":18},"2022-04-01T23:15:13.87",[47],[],{"cveId":87,"name":139,"severity":84,"cvss":82,"added":140,"epss":90,"published":172,"ranges":173,"checked":4,"hits":175,"covers":18},"2020-01-15T17:15:17.347",[28,32,34,174],"11.3.0 to 11.3.2",[]]