[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAd4Nmz80QuKLhmhc1HvLEBBxRHWGPK8Ba1bD5XIt5Wg":3,"g5a-family:oracle\u002Fretail_merchandising_system":139,"g5a-ex:oracle\u002Fretail_merchandising_system@*":140},{"success":4,"data":5},true,{"product":6,"versions":40,"topVulnerabilitiesByEpss":50,"kevVulnerabilities":111,"seoMetadata":117,"meta":136},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":39},"oracle","retail_merchandising_system",9,56,1,"2022-12-26",[14,18,20,23,25,28,31,34,37],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},"14.1",0,false,{"version":19,"cve_count":11,"kev_count":16,"has_kev":17},"14.1.3.2",{"version":21,"cve_count":22,"kev_count":16,"has_kev":17},"15.0",18,{"version":24,"cve_count":22,"kev_count":16,"has_kev":17},"15.0.3",{"version":26,"cve_count":27,"kev_count":16,"has_kev":17},"16.0",6,{"version":29,"cve_count":30,"kev_count":16,"has_kev":17},"16.0.2",4,{"version":32,"cve_count":33,"kev_count":11,"has_kev":4},"16.0.3",13,{"version":35,"cve_count":36,"kev_count":11,"has_kev":4},"19.0.1",12,{"version":38,"cve_count":11,"kev_count":16,"has_kev":17},"5.0.3.1","Retail Merchandising System by Oracle is a technology product with 9 tracked versions and 56 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[41,42,43,44,45,46,47,48,49],{"version":15,"cve_count":11,"kev_count":16,"has_kev":17},{"version":19,"cve_count":11,"kev_count":16,"has_kev":17},{"version":21,"cve_count":22,"kev_count":16,"has_kev":17},{"version":24,"cve_count":22,"kev_count":16,"has_kev":17},{"version":26,"cve_count":27,"kev_count":16,"has_kev":17},{"version":29,"cve_count":30,"kev_count":16,"has_kev":17},{"version":32,"cve_count":33,"kev_count":11,"has_kev":4},{"version":35,"cve_count":36,"kev_count":11,"has_kev":4},{"version":38,"cve_count":11,"kev_count":16,"has_kev":17},[51,59,66,73,78,84,89,94,100,105],{"cveId":52,"description":53,"publishedDate":54,"cvssScore":55,"cvssVersion":56,"severity":57,"isKev":17,"epssScore":58},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"cvssVersion":56,"severity":64,"isKev":4,"epssScore":65},"CVE-2022-22965","A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","2022-04-01",9.8,"Critical",0.99638,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":56,"severity":71,"isKev":17,"epssScore":72},"CVE-2019-10086","In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.","2019-08-20",7.3,"High",0.28384,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":63,"cvssVersion":56,"severity":64,"isKev":17,"epssScore":77},"CVE-2020-9548","FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).","2020-03-02",0.18921,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":56,"severity":71,"isKev":17,"epssScore":83},"CVE-2020-36179","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.","2021-01-07",8.1,0.17065,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":63,"cvssVersion":56,"severity":64,"isKev":17,"epssScore":88},"CVE-2018-14718","FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.","2019-01-02",0.12679,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":82,"cvssVersion":56,"severity":71,"isKev":17,"epssScore":93},"CVE-2020-35728","FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web\u002Fjavax.servlet.jsp.jstl).","2020-12-27",0.12504,{"cveId":95,"description":96,"publishedDate":97,"cvssScore":98,"cvssVersion":56,"severity":57,"isKev":17,"epssScore":99},"CVE-2022-23437","There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.","2022-01-24",6.5,0.11615,{"cveId":101,"description":102,"publishedDate":103,"cvssScore":98,"cvssVersion":56,"severity":57,"isKev":17,"epssScore":104},"CVE-2020-5421","In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.","2020-09-19",0.11564,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":56,"severity":57,"isKev":17,"epssScore":110},"CVE-2021-29425","In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"\u002F\u002F..\u002Ffoo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value.","2021-04-13",4.8,0.10549,[112],{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"severity":64,"isKev":4,"epssScore":65,"cisaVulnName":113,"cisaDateAdded":114,"cisaShortDescription":115,"cisaRequiredAction":116},"Spring Framework JDK 9+ Remote Code Execution Vulnerability","2022-04-04","Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.","Apply updates per vendor instructions.",{"title":118,"metaDescription":119,"keywords":120,"structuredData":121},"Retail Merchandising System by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Merchandising System by Oracle covering 9 versions with 56 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Merchandising System vulnerabilities, Retail Merchandising System security, Retail Merchandising System CVE, Oracle Retail Merchandising System, Retail Merchandising System threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Merchandising System KEV, Retail Merchandising System exploited vulnerabilities",{"@context":122,"@type":123,"name":124,"description":119,"url":125,"manufacturer":126,"applicationCategory":130,"softwareVersion":131,"mainEntity":132},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Merchandising System","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_merchandising_system",{"@type":127,"name":128,"url":129},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","9 versions tracked",{"@type":133,"name":134,"description":135,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Merchandising System Security Vulnerabilities","Security vulnerabilities affecting Retail Merchandising System by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":137,"apiVersion":138},"2026-10-17T15:10:20.928Z","3.0",[],{"rows":141,"total":11,"capped":17,"failed":16},[142],{"cveId":60,"name":113,"severity":64,"cvss":63,"added":114,"epss":65,"published":143,"ranges":144,"checked":4,"hits":145,"covers":17},"2022-04-01T23:15:13.87",[32,35],[]]