[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN37TVKpNGeCQYvfUtP9djqJVuQ6mLE5F6kMZiAHFPEE":3,"g5a-family:oracle\u002Fretail_xstore_point_of_service":299,"g5a-ex:oracle\u002Fretail_xstore_point_of_service@*":300},{"success":4,"data":5},true,{"product":6,"versions":138,"topVulnerabilitiesByEpss":191,"kevVulnerabilities":250,"seoMetadata":277,"meta":296},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":137},"oracle","retail_xstore_point_of_service",52,125,5,"2022-04-01",[14,19,23,25,28,30,33,35,38,40,42,45,48,50,53,56,59,61,63,66,69,71,73,76,79,81,83,85,87,89,91,93,95,97,99,101,103,106,108,110,112,114,116,118,120,123,125,127,129,131,133,135],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"15.0",31,0,false,{"version":20,"cve_count":21,"kev_count":22,"has_kev":4},"15.0.1",6,1,{"version":24,"cve_count":22,"kev_count":17,"has_kev":18},"15.0.2",{"version":26,"cve_count":27,"kev_count":17,"has_kev":18},"15.0.3",3,{"version":29,"cve_count":11,"kev_count":17,"has_kev":18},"15.0.4",{"version":31,"cve_count":32,"kev_count":17,"has_kev":18},"16.0",28,{"version":34,"cve_count":27,"kev_count":17,"has_kev":18},"16.0.0",{"version":36,"cve_count":37,"kev_count":17,"has_kev":18},"16.0.2",2,{"version":39,"cve_count":22,"kev_count":17,"has_kev":18},"16.0.4",{"version":41,"cve_count":27,"kev_count":17,"has_kev":18},"16.0.5",{"version":43,"cve_count":44,"kev_count":22,"has_kev":4},"16.0.6",55,{"version":46,"cve_count":47,"kev_count":17,"has_kev":18},"17.0",33,{"version":49,"cve_count":27,"kev_count":17,"has_kev":18},"17.0.2",{"version":51,"cve_count":52,"kev_count":17,"has_kev":18},"17.0.3",4,{"version":54,"cve_count":55,"kev_count":22,"has_kev":4},"17.0.4",56,{"version":57,"cve_count":58,"kev_count":17,"has_kev":18},"18.0",21,{"version":60,"cve_count":37,"kev_count":17,"has_kev":18},"18.0.1",{"version":62,"cve_count":27,"kev_count":17,"has_kev":18},"18.0.2",{"version":64,"cve_count":65,"kev_count":22,"has_kev":4},"18.0.3",59,{"version":67,"cve_count":68,"kev_count":17,"has_kev":18},"19.0",16,{"version":70,"cve_count":22,"kev_count":17,"has_kev":18},"19.0.0",{"version":72,"cve_count":27,"kev_count":17,"has_kev":18},"19.0.1",{"version":74,"cve_count":75,"kev_count":22,"has_kev":4},"19.0.2",57,{"version":77,"cve_count":78,"kev_count":27,"has_kev":4},"20.0.1",27,{"version":80,"cve_count":37,"kev_count":37,"has_kev":4},"21.0.0",{"version":82,"cve_count":22,"kev_count":17,"has_kev":18},"21.0.1",{"version":84,"cve_count":22,"kev_count":17,"has_kev":18},"5.0",{"version":86,"cve_count":22,"kev_count":17,"has_kev":18},"5.5",{"version":88,"cve_count":22,"kev_count":17,"has_kev":18},"6.0",{"version":90,"cve_count":37,"kev_count":17,"has_kev":18},"6.0.10",{"version":92,"cve_count":52,"kev_count":22,"has_kev":4},"6.0.11",{"version":94,"cve_count":22,"kev_count":17,"has_kev":18},"6.5",{"version":96,"cve_count":37,"kev_count":17,"has_kev":18},"6.5.10",{"version":98,"cve_count":11,"kev_count":17,"has_kev":18},"6.5.11",{"version":100,"cve_count":17,"kev_count":17,"has_kev":18},"6.5.12",{"version":102,"cve_count":37,"kev_count":17,"has_kev":18},"6.5.4",{"version":104,"cve_count":105,"kev_count":22,"has_kev":4},"7.0",11,{"version":107,"cve_count":37,"kev_count":17,"has_kev":18},"7.0.1",{"version":109,"cve_count":37,"kev_count":17,"has_kev":18},"7.0.2",{"version":111,"cve_count":37,"kev_count":17,"has_kev":18},"7.0.3",{"version":113,"cve_count":37,"kev_count":17,"has_kev":18},"7.0.4",{"version":115,"cve_count":37,"kev_count":17,"has_kev":18},"7.0.5",{"version":117,"cve_count":21,"kev_count":22,"has_kev":4},"7.0.6",{"version":119,"cve_count":17,"kev_count":17,"has_kev":18},"7.0.7",{"version":121,"cve_count":122,"kev_count":22,"has_kev":4},"7.1",35,{"version":124,"cve_count":37,"kev_count":17,"has_kev":18},"7.1.1",{"version":126,"cve_count":37,"kev_count":17,"has_kev":18},"7.1.2",{"version":128,"cve_count":37,"kev_count":17,"has_kev":18},"7.1.3",{"version":130,"cve_count":37,"kev_count":17,"has_kev":18},"7.1.4",{"version":132,"cve_count":37,"kev_count":17,"has_kev":18},"7.1.5",{"version":134,"cve_count":21,"kev_count":22,"has_kev":4},"7.1.6",{"version":136,"cve_count":17,"kev_count":17,"has_kev":18},"7.1.7","Retail Xstore Point Of Service by Oracle is a technology product with 52 tracked versions and 125 known security vulnerabilities including 5 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":21,"kev_count":22,"has_kev":4},{"version":24,"cve_count":22,"kev_count":17,"has_kev":18},{"version":26,"cve_count":27,"kev_count":17,"has_kev":18},{"version":29,"cve_count":11,"kev_count":17,"has_kev":18},{"version":31,"cve_count":32,"kev_count":17,"has_kev":18},{"version":34,"cve_count":27,"kev_count":17,"has_kev":18},{"version":36,"cve_count":37,"kev_count":17,"has_kev":18},{"version":39,"cve_count":22,"kev_count":17,"has_kev":18},{"version":41,"cve_count":27,"kev_count":17,"has_kev":18},{"version":43,"cve_count":44,"kev_count":22,"has_kev":4},{"version":46,"cve_count":47,"kev_count":17,"has_kev":18},{"version":49,"cve_count":27,"kev_count":17,"has_kev":18},{"version":51,"cve_count":52,"kev_count":17,"has_kev":18},{"version":54,"cve_count":55,"kev_count":22,"has_kev":4},{"version":57,"cve_count":58,"kev_count":17,"has_kev":18},{"version":60,"cve_count":37,"kev_count":17,"has_kev":18},{"version":62,"cve_count":27,"kev_count":17,"has_kev":18},{"version":64,"cve_count":65,"kev_count":22,"has_kev":4},{"version":67,"cve_count":68,"kev_count":17,"has_kev":18},{"version":70,"cve_count":22,"kev_count":17,"has_kev":18},{"version":72,"cve_count":27,"kev_count":17,"has_kev":18},{"version":74,"cve_count":75,"kev_count":22,"has_kev":4},{"version":77,"cve_count":78,"kev_count":27,"has_kev":4},{"version":80,"cve_count":37,"kev_count":37,"has_kev":4},{"version":82,"cve_count":22,"kev_count":17,"has_kev":18},{"version":84,"cve_count":22,"kev_count":17,"has_kev":18},{"version":86,"cve_count":22,"kev_count":17,"has_kev":18},{"version":88,"cve_count":22,"kev_count":17,"has_kev":18},{"version":90,"cve_count":37,"kev_count":17,"has_kev":18},{"version":92,"cve_count":52,"kev_count":22,"has_kev":4},{"version":94,"cve_count":22,"kev_count":17,"has_kev":18},{"version":96,"cve_count":37,"kev_count":17,"has_kev":18},{"version":98,"cve_count":11,"kev_count":17,"has_kev":18},{"version":100,"cve_count":17,"kev_count":17,"has_kev":18},{"version":102,"cve_count":37,"kev_count":17,"has_kev":18},{"version":104,"cve_count":105,"kev_count":22,"has_kev":4},{"version":107,"cve_count":37,"kev_count":17,"has_kev":18},{"version":109,"cve_count":37,"kev_count":17,"has_kev":18},{"version":111,"cve_count":37,"kev_count":17,"has_kev":18},{"version":113,"cve_count":37,"kev_count":17,"has_kev":18},{"version":115,"cve_count":37,"kev_count":17,"has_kev":18},{"version":117,"cve_count":21,"kev_count":22,"has_kev":4},{"version":119,"cve_count":17,"kev_count":17,"has_kev":18},{"version":121,"cve_count":122,"kev_count":22,"has_kev":4},{"version":124,"cve_count":37,"kev_count":17,"has_kev":18},{"version":126,"cve_count":37,"kev_count":17,"has_kev":18},{"version":128,"cve_count":37,"kev_count":17,"has_kev":18},{"version":130,"cve_count":37,"kev_count":17,"has_kev":18},{"version":132,"cve_count":37,"kev_count":17,"has_kev":18},{"version":134,"cve_count":21,"kev_count":22,"has_kev":4},{"version":136,"cve_count":17,"kev_count":17,"has_kev":18},[192,200,206,210,216,223,228,234,240,246],{"cveId":193,"description":194,"publishedDate":195,"cvssScore":196,"cvssVersion":197,"severity":198,"isKev":4,"epssScore":199},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99968,{"cveId":201,"description":202,"publishedDate":12,"cvssScore":203,"cvssVersion":197,"severity":204,"isKev":4,"epssScore":205},"CVE-2022-22963","In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.",9.8,"Critical",0.99938,{"cveId":207,"description":208,"publishedDate":12,"cvssScore":203,"cvssVersion":197,"severity":204,"isKev":4,"epssScore":209},"CVE-2022-22965","A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",0.99638,{"cveId":211,"description":212,"publishedDate":213,"cvssScore":214,"cvssVersion":197,"severity":198,"isKev":4,"epssScore":215},"CVE-2021-39144","XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","2021-08-23",8.5,0.98124,{"cveId":217,"description":218,"publishedDate":219,"cvssScore":220,"cvssVersion":197,"severity":221,"isKev":18,"epssScore":222},"CVE-2021-44832","Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.","2021-12-28",6.6,"Medium",0.97906,{"cveId":224,"description":225,"publishedDate":226,"cvssScore":203,"cvssVersion":197,"severity":204,"isKev":18,"epssScore":227},"CVE-2019-10173","It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)","2019-07-23",0.95036,{"cveId":229,"description":230,"publishedDate":231,"cvssScore":232,"cvssVersion":197,"severity":198,"isKev":18,"epssScore":233},"CVE-2019-0227","A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.","2019-05-01",7.5,0.9194,{"cveId":235,"description":236,"publishedDate":237,"cvssScore":238,"cvssVersion":197,"severity":198,"isKev":18,"epssScore":239},"CVE-2020-26217","XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","2020-11-16",8,0.85001,{"cveId":241,"description":242,"publishedDate":243,"cvssScore":244,"cvssVersion":197,"severity":221,"isKev":18,"epssScore":245},"CVE-2021-21351","XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","2021-03-23",5.4,0.82136,{"cveId":247,"description":248,"publishedDate":243,"cvssScore":232,"cvssVersion":197,"severity":198,"isKev":18,"epssScore":249},"CVE-2021-21341","XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.",0.77801,[251,256,260,264,268],{"cveId":211,"description":212,"publishedDate":213,"cvssScore":214,"severity":198,"isKev":4,"epssScore":215,"cisaVulnName":252,"cisaDateAdded":253,"cisaShortDescription":254,"cisaRequiredAction":255},"XStream Remote Code Execution Vulnerability","2023-03-10","XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.","Apply updates per vendor instructions.",{"cveId":201,"description":202,"publishedDate":12,"cvssScore":203,"severity":204,"isKev":4,"epssScore":205,"cisaVulnName":257,"cisaDateAdded":258,"cisaShortDescription":259,"cisaRequiredAction":255},"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","2022-08-25","When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.",{"cveId":207,"description":208,"publishedDate":12,"cvssScore":203,"severity":204,"isKev":4,"epssScore":209,"cisaVulnName":261,"cisaDateAdded":262,"cisaShortDescription":263,"cisaRequiredAction":255},"Spring Framework JDK 9+ Remote Code Execution Vulnerability","2022-04-04","Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.",{"cveId":193,"description":194,"publishedDate":195,"cvssScore":196,"severity":198,"isKev":4,"epssScore":199,"cisaVulnName":265,"cisaDateAdded":266,"cisaShortDescription":267,"cisaRequiredAction":255},"Apache Tomcat Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":269,"description":270,"publishedDate":271,"cvssScore":272,"severity":198,"isKev":4,"epssScore":273,"cisaVulnName":274,"cisaDateAdded":275,"cisaShortDescription":276,"cisaRequiredAction":255},"CVE-2019-0211","In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","2019-04-08",7.8,0.65005,"Apache HTTP Server Privilege Escalation Vulnerability","2021-11-03","Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.",{"title":278,"metaDescription":279,"keywords":280,"structuredData":281},"Retail Xstore Point Of Service by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Retail Xstore Point Of Service by Oracle covering 52 versions with 125 tracked vulnerabilities including 2 critical and 3 high-severity issues and 5 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Retail Xstore Point Of Service vulnerabilities, Retail Xstore Point Of Service security, Retail Xstore Point Of Service CVE, Oracle Retail Xstore Point Of Service, Retail Xstore Point Of Service threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Retail Xstore Point Of Service KEV, Retail Xstore Point Of Service exploited vulnerabilities",{"@context":282,"@type":283,"name":284,"description":279,"url":285,"manufacturer":286,"applicationCategory":290,"softwareVersion":291,"mainEntity":292},"https:\u002F\u002Fschema.org","SoftwareApplication","Retail Xstore Point Of Service","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fretail_xstore_point_of_service",{"@type":287,"name":288,"url":289},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","52 versions tracked",{"@type":293,"name":294,"description":295,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Retail Xstore Point Of Service Security Vulnerabilities","Security vulnerabilities affecting Retail Xstore Point Of Service by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":297,"apiVersion":298},"2026-10-17T12:49:18.477Z","3.0",[],{"rows":301,"total":11,"capped":18,"failed":17},[302,306,310,314,318],{"cveId":211,"name":252,"severity":198,"cvss":214,"added":253,"epss":215,"published":303,"ranges":304,"checked":4,"hits":305,"covers":18},"2021-08-23T18:15:12.087",[43,54,64,74,77],[],{"cveId":201,"name":257,"severity":204,"cvss":203,"added":258,"epss":205,"published":307,"ranges":308,"checked":4,"hits":309,"covers":18},"2022-04-01T23:15:13.663",[77,80],[],{"cveId":207,"name":261,"severity":204,"cvss":203,"added":262,"epss":209,"published":311,"ranges":312,"checked":4,"hits":313,"covers":18},"2022-04-01T23:15:13.87",[77,80],[],{"cveId":193,"name":265,"severity":198,"cvss":196,"added":266,"epss":199,"published":315,"ranges":316,"checked":4,"hits":317,"covers":18},"2017-10-04T01:29:02.12",[92,117,134,20],[],{"cveId":269,"name":274,"severity":198,"cvss":272,"added":275,"epss":273,"published":319,"ranges":320,"checked":4,"hits":321,"covers":18},"2019-04-08T22:29:00.387",[104,121],[]]