[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg4Ea-52UdsIPkY9ZSc3vuKS_NEPpOGAONWzuUH4CnmM":3,"g5a-family:oracle\u002Fretail_advanced_inventory_planning":127,"g5a-ex:oracle\u002Fretail_advanced_inventory_planning@*":128},{"success":4,"data":5},true,{"product":6,"versions":32,"topVulnerabilitiesByEpss":39,"kevVulnerabilities":99,"seoMetadata":105,"meta":124},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":31},"oracle","retail_advanced_inventory_planning",6,12,1,"2021-07-14",[14,16,18,22,25,28],{"version":15,"cve_count":11,"kev_count":11,"has_kev":4},"13.2",{"version":17,"cve_count":11,"kev_count":11,"has_kev":4},"13.4",{"version":19,"cve_count":11,"kev_count":20,"has_kev":21},"14.0",0,false,{"version":23,"cve_count":24,"kev_count":11,"has_kev":4},"14.1",7,{"version":26,"cve_count":27,"kev_count":11,"has_kev":4},"15.0",9,{"version":29,"cve_count":30,"kev_count":20,"has_kev":21},"16.0",4,"Retail Advanced Inventory Planning by Oracle is a technology product with 6 tracked versions and 12 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[33,34,35,36,37,38],{"version":15,"cve_count":11,"kev_count":11,"has_kev":4},{"version":17,"cve_count":11,"kev_count":11,"has_kev":4},{"version":19,"cve_count":11,"kev_count":20,"has_kev":21},{"version":23,"cve_count":24,"kev_count":11,"has_kev":4},{"version":26,"cve_count":27,"kev_count":11,"has_kev":4},{"version":29,"cve_count":30,"kev_count":20,"has_kev":21},[40,48,55,61,67,74,79,84,90,95],{"cveId":41,"description":42,"publishedDate":43,"cvssScore":44,"cvssVersion":45,"severity":46,"isKev":4,"epssScore":47},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99968,{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"cvssVersion":45,"severity":53,"isKev":21,"epssScore":54},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",9.8,"Critical",0.89792,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":45,"severity":46,"isKev":21,"epssScore":60},"CVE-2019-10086","In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","2019-08-20",7.3,0.28384,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":45,"severity":46,"isKev":21,"epssScore":66},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",7.5,0.09207,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":45,"severity":72,"isKev":21,"epssScore":73},"CVE-2020-9488","Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1","2020-04-27",3.7,"Low",0.08216,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":65,"cvssVersion":45,"severity":46,"isKev":21,"epssScore":78},"CVE-2020-11979","As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.","2020-10-01",0.08016,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":65,"cvssVersion":45,"severity":46,"isKev":21,"epssScore":83},"CVE-2018-11040","Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.","2018-06-25",0.03229,{"cveId":85,"description":86,"publishedDate":82,"cvssScore":87,"cvssVersion":45,"severity":88,"isKev":21,"epssScore":89},"CVE-2018-11039","Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.",5.9,"Medium",0.02746,{"cveId":91,"description":92,"publishedDate":12,"cvssScore":93,"cvssVersion":45,"severity":88,"isKev":21,"epssScore":94},"CVE-2021-36374","When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.",5.5,0.0263,{"cveId":96,"description":97,"publishedDate":12,"cvssScore":93,"cvssVersion":45,"severity":88,"isKev":21,"epssScore":98},"CVE-2021-36373","When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.",0.02521,[100],{"cveId":41,"description":42,"publishedDate":43,"cvssScore":44,"severity":46,"isKev":4,"epssScore":47,"cisaVulnName":101,"cisaDateAdded":102,"cisaShortDescription":103,"cisaRequiredAction":104},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"title":106,"metaDescription":107,"keywords":108,"structuredData":109},"Retail Advanced Inventory Planning by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Advanced Inventory Planning by Oracle covering 6 versions with 12 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Advanced Inventory Planning vulnerabilities, Retail Advanced Inventory Planning security, Retail Advanced Inventory Planning CVE, Oracle Retail Advanced Inventory Planning, Retail Advanced Inventory Planning threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Advanced Inventory Planning KEV, Retail Advanced Inventory Planning exploited vulnerabilities",{"@context":110,"@type":111,"name":112,"description":107,"url":113,"manufacturer":114,"applicationCategory":118,"softwareVersion":119,"mainEntity":120},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Advanced Inventory Planning","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_advanced_inventory_planning",{"@type":115,"name":116,"url":117},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","6 versions tracked",{"@type":121,"name":122,"description":123,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Advanced Inventory Planning Security Vulnerabilities","Security vulnerabilities affecting Retail Advanced Inventory Planning by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":125,"apiVersion":126},"2026-10-17T18:25:51.643Z","3.0",[],{"rows":129,"total":11,"capped":21,"failed":20},[130],{"cveId":41,"name":101,"severity":46,"cvss":44,"added":102,"epss":47,"published":131,"ranges":132,"checked":4,"hits":133,"covers":21},"2017-10-04T01:29:02.12",[15,17,23,26],[]]