[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAzB5Y9cZtaPHCHo5GZuQJFnZKMITVORbavg0tdigBcg":3,"g5a-ex:oracle\u002Fretail_clearance_optimization_engine@*":91,"g5a-family:oracle\u002Fretail_clearance_optimization_engine":93},{"success":4,"data":5},true,{"product":6,"versions":26,"topVulnerabilitiesByEpss":31,"kevVulnerabilities":68,"seoMetadata":69,"meta":88},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":25},"oracle","retail_clearance_optimization_engine",4,6,0,"2019-10-23",[14,18,20,22],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"13.4",1,false,{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},"14.0",{"version":21,"cve_count":16,"kev_count":11,"has_kev":17},"14.0.3",{"version":23,"cve_count":24,"kev_count":11,"has_kev":17},"14.0.5",5,"Retail Clearance Optimization Engine by Oracle is a technology product with 4 tracked versions and 6 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[27,28,29,30],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":16,"kev_count":11,"has_kev":17},{"version":21,"cve_count":16,"kev_count":11,"has_kev":17},{"version":23,"cve_count":24,"kev_count":11,"has_kev":17},[32,40,45,52,57,63],{"cveId":33,"description":34,"publishedDate":35,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":39},"CVE-2017-5645","In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","2017-04-17",9.8,"v3.1","Critical",0.89792,{"cveId":41,"description":42,"publishedDate":43,"cvssScore":36,"cvssVersion":37,"severity":38,"isKev":17,"epssScore":44},"CVE-2019-2904","Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H).","2019-10-16",0.14264,{"cveId":46,"description":47,"publishedDate":48,"cvssScore":49,"cvssVersion":37,"severity":50,"isKev":17,"epssScore":51},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",7.5,"High",0.09207,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":49,"cvssVersion":37,"severity":50,"isKev":17,"epssScore":56},"CVE-2018-11040","Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the \"jsonp\" and \"callback\" JSONP parameters, enabling cross-domain requests.","2018-06-25",0.03229,{"cveId":58,"description":59,"publishedDate":55,"cvssScore":60,"cvssVersion":37,"severity":61,"isKev":17,"epssScore":62},"CVE-2018-11039","Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.",5.9,"Medium",0.02746,{"cveId":64,"description":65,"publishedDate":12,"cvssScore":66,"cvssVersion":37,"severity":61,"isKev":17,"epssScore":67},"CVE-2019-12415","In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.",5.5,0.00998,[],{"title":70,"metaDescription":71,"keywords":72,"structuredData":73},"Retail Clearance Optimization Engine by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Clearance Optimization Engine by Oracle covering 4 versions with 6 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Clearance Optimization Engine vulnerabilities, Retail Clearance Optimization Engine security, Retail Clearance Optimization Engine CVE, Oracle Retail Clearance Optimization Engine, Retail Clearance Optimization Engine threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":74,"@type":75,"name":76,"description":71,"url":77,"manufacturer":78,"applicationCategory":82,"softwareVersion":83,"mainEntity":84},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Clearance Optimization Engine","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_clearance_optimization_engine",{"@type":79,"name":80,"url":81},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","4 versions tracked",{"@type":85,"name":86,"description":87,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Clearance Optimization Engine Security Vulnerabilities","Security vulnerabilities affecting Retail Clearance Optimization Engine by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":89,"apiVersion":90},"2026-10-19T01:59:14.723Z","3.0",{"rows":92,"total":11,"capped":17,"failed":11},[],[]]