[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSVRCARMTv8XwR_MhExHcooYBZ-DUogxTD4vt6iqwbEc":3,"g5a-family:oracle\u002Fretail_financial_integration":155,"g5a-ex:oracle\u002Fretail_financial_integration@*":156},{"success":4,"data":5},true,{"product":6,"versions":53,"topVulnerabilitiesByEpss":69,"kevVulnerabilities":127,"seoMetadata":133,"meta":152},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":52},"oracle","retail_financial_integration",15,19,1,"2022-04-01",[14,19,22,24,26,29,32,34,36,38,40,42,44,47,49],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"13.2",2,0,false,{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},"14.0",3,{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},"14.1",{"version":25,"cve_count":16,"kev_count":17,"has_kev":18},"14.1.3",{"version":27,"cve_count":28,"kev_count":11,"has_kev":4},"14.1.3.2",10,{"version":30,"cve_count":31,"kev_count":17,"has_kev":18},"15.0",7,{"version":33,"cve_count":16,"kev_count":17,"has_kev":18},"15.0.3",{"version":35,"cve_count":31,"kev_count":11,"has_kev":4},"15.0.3.1",{"version":37,"cve_count":21,"kev_count":17,"has_kev":18},"15.0.4.0",{"version":39,"cve_count":31,"kev_count":17,"has_kev":18},"16.0",{"version":41,"cve_count":11,"kev_count":17,"has_kev":18},"16.0.1",{"version":43,"cve_count":31,"kev_count":11,"has_kev":4},"16.0.3",{"version":45,"cve_count":46,"kev_count":17,"has_kev":18},"16.0.3.0",4,{"version":48,"cve_count":16,"kev_count":17,"has_kev":18},"19.0.0",{"version":50,"cve_count":51,"kev_count":11,"has_kev":4},"19.0.1",6,"Retail Financial Integration by Oracle is a technology product with 15 tracked versions and 19 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[54,55,56,57,58,59,60,61,62,63,64,65,66,67,68],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":17,"has_kev":18},{"version":23,"cve_count":21,"kev_count":17,"has_kev":18},{"version":25,"cve_count":16,"kev_count":17,"has_kev":18},{"version":27,"cve_count":28,"kev_count":11,"has_kev":4},{"version":30,"cve_count":31,"kev_count":17,"has_kev":18},{"version":33,"cve_count":16,"kev_count":17,"has_kev":18},{"version":35,"cve_count":31,"kev_count":11,"has_kev":4},{"version":37,"cve_count":21,"kev_count":17,"has_kev":18},{"version":39,"cve_count":31,"kev_count":17,"has_kev":18},{"version":41,"cve_count":11,"kev_count":17,"has_kev":18},{"version":43,"cve_count":31,"kev_count":11,"has_kev":4},{"version":45,"cve_count":46,"kev_count":17,"has_kev":18},{"version":48,"cve_count":16,"kev_count":17,"has_kev":18},{"version":50,"cve_count":51,"kev_count":11,"has_kev":4},[70,78,84,91,96,102,107,112,117,122],{"cveId":71,"description":72,"publishedDate":73,"cvssScore":74,"cvssVersion":75,"severity":76,"isKev":18,"epssScore":77},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":79,"description":80,"publishedDate":12,"cvssScore":81,"cvssVersion":75,"severity":82,"isKev":4,"epssScore":83},"CVE-2022-22965","A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",9.8,"Critical",0.99638,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":88,"cvssVersion":75,"severity":89,"isKev":18,"epssScore":90},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",7.5,"High",0.88768,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":88,"cvssVersion":75,"severity":89,"isKev":18,"epssScore":95},"CVE-2021-42340","The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.","2021-10-14",0.11796,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":100,"cvssVersion":75,"severity":76,"isKev":18,"epssScore":101},"CVE-2022-23437","There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.","2022-01-24",6.5,0.11615,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":100,"cvssVersion":75,"severity":76,"isKev":18,"epssScore":106},"CVE-2020-5421","In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.","2020-09-19",0.11564,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":88,"cvssVersion":75,"severity":89,"isKev":18,"epssScore":111},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",0.09207,{"cveId":113,"description":114,"publishedDate":115,"cvssScore":88,"cvssVersion":75,"severity":89,"isKev":18,"epssScore":116},"CVE-2020-11979","As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.","2020-10-01",0.08016,{"cveId":118,"description":119,"publishedDate":120,"cvssScore":88,"cvssVersion":75,"severity":89,"isKev":18,"epssScore":121},"CVE-2021-40690","All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the \"secureValidation\" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.","2021-09-19",0.07441,{"cveId":123,"description":124,"publishedDate":125,"cvssScore":74,"cvssVersion":75,"severity":76,"isKev":18,"epssScore":126},"CVE-2018-11039","Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.","2018-06-25",0.02746,[128],{"cveId":79,"description":80,"publishedDate":12,"cvssScore":81,"severity":82,"isKev":4,"epssScore":83,"cisaVulnName":129,"cisaDateAdded":130,"cisaShortDescription":131,"cisaRequiredAction":132},"Spring Framework JDK 9+ Remote Code Execution Vulnerability","2022-04-04","Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.","Apply updates per vendor instructions.",{"title":134,"metaDescription":135,"keywords":136,"structuredData":137},"Retail Financial Integration by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Financial Integration by Oracle covering 15 versions with 19 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Financial Integration vulnerabilities, Retail Financial Integration security, Retail Financial Integration CVE, Oracle Retail Financial Integration, Retail Financial Integration threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Financial Integration KEV, Retail Financial Integration exploited vulnerabilities",{"@context":138,"@type":139,"name":140,"description":135,"url":141,"manufacturer":142,"applicationCategory":146,"softwareVersion":147,"mainEntity":148},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Financial Integration","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_financial_integration",{"@type":143,"name":144,"url":145},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","15 versions tracked",{"@type":149,"name":150,"description":151,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Financial Integration Security Vulnerabilities","Security vulnerabilities affecting Retail Financial Integration by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":153,"apiVersion":154},"2026-10-17T17:46:29.121Z","3.0",[],{"rows":157,"total":11,"capped":18,"failed":17},[158],{"cveId":79,"name":129,"severity":82,"cvss":81,"added":130,"epss":83,"published":159,"ranges":160,"checked":4,"hits":161,"covers":18},"2022-04-01T23:15:13.87",[27,35,43,50],[]]