[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flfpv12X07UlulTYBs9dnvkBedA8zmxlIdLGa7crVqzA":3,"g5a-family:oracle\u002Fretail_assortment_planning":131,"g5a-ex:oracle\u002Fretail_assortment_planning@*":132},{"success":4,"data":5},true,{"product":6,"versions":34,"topVulnerabilitiesByEpss":42,"kevVulnerabilities":103,"seoMetadata":109,"meta":128},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":33},"oracle","retail_assortment_planning",7,20,1,"2021-12-28",[14,19,22,24,27,29,31],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"14.1",2,0,false,{"version":20,"cve_count":21,"kev_count":11,"has_kev":4},"15.0",6,{"version":23,"cve_count":11,"kev_count":17,"has_kev":18},"15.0.3",{"version":25,"cve_count":26,"kev_count":17,"has_kev":18},"15.0.3.0",5,{"version":28,"cve_count":9,"kev_count":11,"has_kev":4},"16.0",{"version":30,"cve_count":9,"kev_count":17,"has_kev":18},"16.0.3",{"version":32,"cve_count":21,"kev_count":17,"has_kev":18},"16.0.3.0","Retail Assortment Planning by Oracle is a technology product with 7 tracked versions and 20 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[35,36,37,38,39,40,41],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":11,"has_kev":4},{"version":23,"cve_count":11,"kev_count":17,"has_kev":18},{"version":25,"cve_count":26,"kev_count":17,"has_kev":18},{"version":28,"cve_count":9,"kev_count":11,"has_kev":4},{"version":30,"cve_count":9,"kev_count":17,"has_kev":18},{"version":32,"cve_count":21,"kev_count":17,"has_kev":18},[43,50,57,64,69,75,81,86,93,98],{"cveId":44,"description":45,"publishedDate":12,"cvssScore":46,"cvssVersion":47,"severity":48,"isKev":18,"epssScore":49},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.",6.6,"v3.1","Medium",0.97906,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":4,"epssScore":56},"CVE-2020-2555","Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2020-01-15",9.8,"Critical",0.97116,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":47,"severity":62,"isKev":18,"epssScore":63},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",7.5,"High",0.88768,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":54,"cvssVersion":47,"severity":55,"isKev":18,"epssScore":68},"CVE-2019-2904","Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2019-10-16",0.14264,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"cvssVersion":47,"severity":48,"isKev":18,"epssScore":74},"CVE-2020-5421","In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.","2020-09-19",6.5,0.11564,{"cveId":76,"description":77,"publishedDate":78,"cvssScore":79,"cvssVersion":47,"severity":48,"isKev":18,"epssScore":80},"CVE-2021-29425","In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"\u002F\u002F..\u002Ffoo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.","2021-04-13",4.8,0.10549,{"cveId":82,"description":83,"publishedDate":84,"cvssScore":61,"cvssVersion":47,"severity":62,"isKev":18,"epssScore":85},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",0.09207,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":90,"cvssVersion":47,"severity":91,"isKev":18,"epssScore":92},"CVE-2020-9488","Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1","2020-04-27",3.7,"Low",0.08216,{"cveId":94,"description":95,"publishedDate":96,"cvssScore":61,"cvssVersion":47,"severity":62,"isKev":18,"epssScore":97},"CVE-2020-11979","As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.","2020-10-01",0.08016,{"cveId":99,"description":100,"publishedDate":101,"cvssScore":73,"cvssVersion":47,"severity":48,"isKev":18,"epssScore":102},"CVE-2019-3740","RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.","2019-09-18",0.03889,[104],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"severity":55,"isKev":4,"epssScore":56,"cisaVulnName":105,"cisaDateAdded":106,"cisaShortDescription":107,"cisaRequiredAction":108},"Oracle Multiple Products Remote Code Execution Vulnerability","2021-11-03","Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).","Apply updates per vendor instructions.",{"title":110,"metaDescription":111,"keywords":112,"structuredData":113},"Retail Assortment Planning by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Assortment Planning by Oracle covering 7 versions with 20 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Assortment Planning vulnerabilities, Retail Assortment Planning security, Retail Assortment Planning CVE, Oracle Retail Assortment Planning, Retail Assortment Planning threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Assortment Planning KEV, Retail Assortment Planning exploited vulnerabilities",{"@context":114,"@type":115,"name":116,"description":111,"url":117,"manufacturer":118,"applicationCategory":122,"softwareVersion":123,"mainEntity":124},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Assortment Planning","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_assortment_planning",{"@type":119,"name":120,"url":121},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","7 versions tracked",{"@type":125,"name":126,"description":127,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Assortment Planning Security Vulnerabilities","Security vulnerabilities affecting Retail Assortment Planning by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":129,"apiVersion":130},"2026-10-17T19:08:40.435Z","3.0",[],{"rows":133,"total":11,"capped":18,"failed":17},[134],{"cveId":51,"name":105,"severity":55,"cvss":54,"added":106,"epss":56,"published":135,"ranges":136,"checked":4,"hits":137,"covers":18},"2020-01-15T17:15:17.347",[20,28],[]]