[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRkYV26mBbYn7x102Z9osQBNNLRcEwcPiz8y2BVkIY2s":3,"g5a-family:oracle\u002Fretail_invoice_matching":140,"g5a-ex:oracle\u002Fretail_invoice_matching@*":141},{"success":4,"data":5},true,{"product":6,"versions":41,"topVulnerabilitiesByEpss":52,"kevVulnerabilities":112,"seoMetadata":118,"meta":137},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":40},"oracle","retail_invoice_matching",10,12,1,"2021-12-18",[14,17,19,22,24,27,29,31,35,37],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},"12.0",3,{"version":18,"cve_count":16,"kev_count":11,"has_kev":4},"13.0",{"version":20,"cve_count":21,"kev_count":11,"has_kev":4},"13.1",2,{"version":23,"cve_count":16,"kev_count":11,"has_kev":4},"13.2",{"version":25,"cve_count":26,"kev_count":11,"has_kev":4},"14.0",4,{"version":28,"cve_count":26,"kev_count":11,"has_kev":4},"14.1",{"version":30,"cve_count":21,"kev_count":11,"has_kev":4},"15.0",{"version":32,"cve_count":21,"kev_count":33,"has_kev":34},"15.0.3",0,false,{"version":36,"cve_count":21,"kev_count":11,"has_kev":4},"16.0",{"version":38,"cve_count":39,"kev_count":33,"has_kev":34},"16.0.3",5,"Retail Invoice Matching by Oracle is a technology product with 10 tracked versions and 12 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[42,43,44,45,46,47,48,49,50,51],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},{"version":18,"cve_count":16,"kev_count":11,"has_kev":4},{"version":20,"cve_count":21,"kev_count":11,"has_kev":4},{"version":23,"cve_count":16,"kev_count":11,"has_kev":4},{"version":25,"cve_count":26,"kev_count":11,"has_kev":4},{"version":28,"cve_count":26,"kev_count":11,"has_kev":4},{"version":30,"cve_count":21,"kev_count":11,"has_kev":4},{"version":32,"cve_count":21,"kev_count":33,"has_kev":34},{"version":36,"cve_count":21,"kev_count":11,"has_kev":4},{"version":38,"cve_count":39,"kev_count":33,"has_kev":34},[53,60,67,74,80,86,92,98,102,107],{"cveId":54,"description":55,"publishedDate":12,"cvssScore":56,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":59},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.",5.9,"v3.1","Medium",0.99999,{"cveId":61,"description":62,"publishedDate":63,"cvssScore":64,"cvssVersion":57,"severity":65,"isKev":4,"epssScore":66},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99968,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":72,"severity":58,"isKev":34,"epssScore":73},"CVE-2015-9251","jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text\u002Fjavascript responses to be executed.","2018-01-18",6.1,"v3.0",0.29726,{"cveId":75,"description":76,"publishedDate":77,"cvssScore":78,"cvssVersion":57,"severity":65,"isKev":34,"epssScore":79},"CVE-2019-10086","In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","2019-08-20",7.3,0.28384,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":84,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":85},"CVE-2020-5421","In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.","2020-09-19",6.5,0.11564,{"cveId":87,"description":88,"publishedDate":89,"cvssScore":90,"cvssVersion":57,"severity":65,"isKev":34,"epssScore":91},"CVE-2018-15756","Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.","2018-10-18",7.5,0.09207,{"cveId":93,"description":94,"publishedDate":95,"cvssScore":96,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":97},"CVE-2021-36374","When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.","2021-07-14",5.5,0.0263,{"cveId":99,"description":100,"publishedDate":95,"cvssScore":96,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":101},"CVE-2021-36373","When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.",0.02521,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":71,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":106},"CVE-2019-17091","faces\u002Fcontext\u002FPartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","2019-10-02",0.02469,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":71,"cvssVersion":57,"severity":58,"isKev":34,"epssScore":111},"CVE-2019-10219","A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.","2019-11-08",0.02157,[113],{"cveId":61,"description":62,"publishedDate":63,"cvssScore":64,"severity":65,"isKev":4,"epssScore":66,"cisaVulnName":114,"cisaDateAdded":115,"cisaShortDescription":116,"cisaRequiredAction":117},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"title":119,"metaDescription":120,"keywords":121,"structuredData":122},"Retail Invoice Matching by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Invoice Matching by Oracle covering 10 versions with 12 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Invoice Matching vulnerabilities, Retail Invoice Matching security, Retail Invoice Matching CVE, Oracle Retail Invoice Matching, Retail Invoice Matching threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Invoice Matching KEV, Retail Invoice Matching exploited vulnerabilities",{"@context":123,"@type":124,"name":125,"description":120,"url":126,"manufacturer":127,"applicationCategory":131,"softwareVersion":132,"mainEntity":133},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Invoice Matching","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_invoice_matching",{"@type":128,"name":129,"url":130},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","10 versions tracked",{"@type":134,"name":135,"description":136,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Invoice Matching Security Vulnerabilities","Security vulnerabilities affecting Retail Invoice Matching by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":138,"apiVersion":139},"2026-10-18T18:16:06.116Z","3.0",[],{"rows":142,"total":11,"capped":34,"failed":33},[143],{"cveId":61,"name":114,"severity":65,"cvss":64,"added":115,"epss":66,"published":144,"ranges":145,"checked":4,"hits":146,"covers":34},"2017-10-04T01:29:02.12",[15,18,20,23,25,28,30,36],[]]