[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ferlKMw6E-REzQKRjkqQH2anYB8X-kXE5mFHqK7hwFSU":3,"g5a-family:oracle\u002Fretail_central_office":125,"g5a-ex:oracle\u002Fretail_central_office@*":126},{"success":4,"data":5},true,{"product":6,"versions":30,"topVulnerabilitiesByEpss":36,"kevVulnerabilities":97,"seoMetadata":103,"meta":122},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":29},"oracle","retail_central_office",5,20,1,"2021-12-18",[14,18,21,24,27],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},"13.4.9",0,false,{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},"14.0",9,{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},"14.0.4",2,{"version":25,"cve_count":26,"kev_count":16,"has_kev":17},"14.1",18,{"version":28,"cve_count":23,"kev_count":11,"has_kev":4},"14.1.3","Retail Central Office by Oracle is a technology product with 5 tracked versions and 20 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[31,32,33,34,35],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},{"version":22,"cve_count":23,"kev_count":11,"has_kev":4},{"version":25,"cve_count":26,"kev_count":16,"has_kev":17},{"version":28,"cve_count":23,"kev_count":11,"has_kev":4},[37,44,51,57,63,70,74,80,86,91],{"cveId":38,"description":39,"publishedDate":12,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":17,"epssScore":43},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",5.9,"v3.1","Medium",0.99999,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":41,"severity":49,"isKev":4,"epssScore":50},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99968,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"cvssVersion":41,"severity":49,"isKev":17,"epssScore":56},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",7.5,0.88768,{"cveId":58,"description":59,"publishedDate":60,"cvssScore":61,"cvssVersion":41,"severity":42,"isKev":17,"epssScore":62},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",6.1,0.8682,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":41,"severity":68,"isKev":17,"epssScore":69},"CVE-2018-1270","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","2018-04-06",9.8,"Critical",0.77476,{"cveId":71,"description":72,"publishedDate":66,"cvssScore":40,"cvssVersion":41,"severity":42,"isKev":17,"epssScore":73},"CVE-2018-1271","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.",0.34444,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":78,"cvssVersion":41,"severity":49,"isKev":17,"epssScore":79},"CVE-2019-10086","In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","2019-08-20",7.3,0.28384,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":67,"cvssVersion":84,"severity":68,"isKev":17,"epssScore":85},"CVE-2018-8013","In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.","2018-05-24","v3.0",0.18925,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":67,"cvssVersion":41,"severity":68,"isKev":17,"epssScore":90},"CVE-2019-13990","initDocumentParser in xml\u002FXMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.","2019-07-26",0.16628,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":41,"severity":49,"isKev":17,"epssScore":96},"CVE-2020-11987","Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.","2021-02-24",8.2,0.1328,[98],{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"severity":49,"isKev":4,"epssScore":50,"cisaVulnName":99,"cisaDateAdded":100,"cisaShortDescription":101,"cisaRequiredAction":102},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"title":104,"metaDescription":105,"keywords":106,"structuredData":107},"Retail Central Office by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Central Office by Oracle covering 5 versions with 20 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Central Office vulnerabilities, Retail Central Office security, Retail Central Office CVE, Oracle Retail Central Office, Retail Central Office threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Central Office KEV, Retail Central Office exploited vulnerabilities",{"@context":108,"@type":109,"name":110,"description":105,"url":111,"manufacturer":112,"applicationCategory":116,"softwareVersion":117,"mainEntity":118},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Central Office","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_central_office",{"@type":113,"name":114,"url":115},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","5 versions tracked",{"@type":119,"name":120,"description":121,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Central Office Security Vulnerabilities","Security vulnerabilities affecting Retail Central Office by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":123,"apiVersion":124},"2026-10-17T19:32:34.593Z","3.0",[],{"rows":127,"total":11,"capped":17,"failed":16},[128],{"cveId":45,"name":99,"severity":49,"cvss":48,"added":100,"epss":50,"published":129,"ranges":130,"checked":4,"hits":131,"covers":17},"2017-10-04T01:29:02.12",[22,28],[]]