[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpDWTyqlYdDrjXOHwS3O53-J-cFd7U5M0T4JuV1ln_io":3,"g5a-family:oracle\u002Fretail_order_broker":138,"g5a-ex:oracle\u002Fretail_order_broker@*":142},{"success":4,"data":5},true,{"product":6,"versions":40,"topVulnerabilitiesByEpss":49,"kevVulnerabilities":110,"seoMetadata":116,"meta":135},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":39},"oracle","retail_order_broker",8,39,1,"2022-05-01",[14,17,20,25,28,31,33,36],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},"15.0",29,{"version":18,"cve_count":19,"kev_count":11,"has_kev":4},"16.0",26,{"version":21,"cve_count":22,"kev_count":23,"has_kev":24},"18.0",10,0,false,{"version":26,"cve_count":27,"kev_count":23,"has_kev":24},"19.0",2,{"version":29,"cve_count":30,"kev_count":23,"has_kev":24},"19.1",7,{"version":32,"cve_count":11,"kev_count":11,"has_kev":4},"5.0",{"version":34,"cve_count":35,"kev_count":11,"has_kev":4},"5.1",11,{"version":37,"cve_count":38,"kev_count":11,"has_kev":4},"5.2",12,"Retail Order Broker by Oracle is a technology product with 8 tracked versions and 39 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[41,42,43,44,45,46,47,48],{"version":15,"cve_count":16,"kev_count":11,"has_kev":4},{"version":18,"cve_count":19,"kev_count":11,"has_kev":4},{"version":21,"cve_count":22,"kev_count":23,"has_kev":24},{"version":26,"cve_count":27,"kev_count":23,"has_kev":24},{"version":29,"cve_count":30,"kev_count":23,"has_kev":24},{"version":32,"cve_count":11,"kev_count":11,"has_kev":4},{"version":34,"cve_count":35,"kev_count":11,"has_kev":4},{"version":37,"cve_count":38,"kev_count":11,"has_kev":4},[50,58,65,71,78,84,89,96,101,106],{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":24,"epssScore":57},"CVE-2021-45105","Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","2021-12-18",5.9,"v3.1","Medium",0.99999,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"cvssVersion":55,"severity":63,"isKev":4,"epssScore":64},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"High",0.99968,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":69,"cvssVersion":55,"severity":56,"isKev":24,"epssScore":70},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","2021-12-28",6.6,0.97906,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":75,"cvssVersion":76,"severity":56,"isKev":24,"epssScore":77},"CVE-2018-11784","When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '\u002Ffoo\u002F' when the user requested '\u002Ffoo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","2018-10-04",4.3,"v3.0",0.9768,{"cveId":79,"description":80,"publishedDate":81,"cvssScore":82,"cvssVersion":55,"severity":63,"isKev":24,"epssScore":83},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,0.9194,{"cveId":85,"description":86,"publishedDate":87,"cvssScore":82,"cvssVersion":55,"severity":63,"isKev":24,"epssScore":88},"CVE-2020-5398","In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a \"Content-Disposition\" header in the response where the filename attribute is derived from user supplied input.","2020-01-17",0.88768,{"cveId":90,"description":91,"publishedDate":92,"cvssScore":93,"cvssVersion":55,"severity":94,"isKev":24,"epssScore":95},"CVE-2018-1270","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.","2018-04-06",9.8,"Critical",0.77476,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":93,"cvssVersion":55,"severity":94,"isKev":24,"epssScore":100},"CVE-2018-1275","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.","2018-04-11",0.57414,{"cveId":102,"description":103,"publishedDate":104,"cvssScore":30,"cvssVersion":55,"severity":63,"isKev":24,"epssScore":105},"CVE-2020-9484","When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","2020-05-20",0.5552,{"cveId":107,"description":108,"publishedDate":92,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":24,"epssScore":109},"CVE-2018-1271","Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.",0.34444,[111],{"cveId":59,"description":60,"publishedDate":61,"cvssScore":62,"severity":63,"isKev":4,"epssScore":64,"cisaVulnName":112,"cisaDateAdded":113,"cisaShortDescription":114,"cisaRequiredAction":115},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","Apply updates per vendor instructions.",{"title":117,"metaDescription":118,"keywords":119,"structuredData":120},"Retail Order Broker by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Order Broker by Oracle covering 8 versions with 39 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Order Broker vulnerabilities, Retail Order Broker security, Retail Order Broker CVE, Oracle Retail Order Broker, Retail Order Broker threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Order Broker KEV, Retail Order Broker exploited vulnerabilities",{"@context":121,"@type":122,"name":123,"description":118,"url":124,"manufacturer":125,"applicationCategory":129,"softwareVersion":130,"mainEntity":131},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Order Broker","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_order_broker",{"@type":126,"name":127,"url":128},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","8 versions tracked",{"@type":132,"name":133,"description":134,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Order Broker Security Vulnerabilities","Security vulnerabilities affecting Retail Order Broker by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":136,"apiVersion":137},"2026-10-17T15:10:21.575Z","3.0",[139],{"product":140,"cves":141},"retail_order_broker_cloud_service",6,{"rows":143,"total":11,"capped":24,"failed":11},[144],{"cveId":59,"name":112,"severity":63,"cvss":62,"added":113,"epss":64,"published":61,"ranges":145,"hits":146,"checked":24,"covers":24},[],[]]