Oracle Retail Xstore Point Of Service vulnerabilities, page 4
127 vulnerabilities
Known vulnerabilities in Oracle Retail Xstore Point Of Service, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-9547chainguardeco-java-gradle-2.10+86
EPSS score18.38%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).CVE-2020-9546chainguardeco-java-gradle-4.10+61EPSS score4.58%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).CVE-2020-9548chainguardeco-java-gradle-2.10+95EPSS score18.92%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).CVE-2020-36180chainguardeco-java-gradle-2.10+115EPSS score4.09%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.CVE-2020-36187chainguardeco-java-gradle-2.10+115EPSS score4.24%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.CVE-2020-36181chainguardeco-java-gradle-2.10+114EPSS score4.09%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.CVE-2020-36185chainguardeco-java-gradle-2.10+115EPSS score4.24%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.CVE-2020-36184chainguardeco-java-gradle-2.10+115EPSS score8.36%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.CVE-2020-36183chainguardeco-java-gradle-2.10+115EPSS score4.97%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.CVE-2020-36182chainguardeco-java-gradle-2.10+115EPSS score4.09%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.CVE-2020-36179chainguardeco-java-gradle-2.10+113EPSS score17.07%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.CVE-2020-36189chainguardeco-java-gradle-2.10+110EPSS score3.99%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.CVE-2020-36186chainguardeco-java-gradle-2.10+115EPSS score4.24%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource.CVE-2020-36188chainguardeco-java-gradle-2.10+115EPSS score8.79%
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.CVE-2020-25649apacheiotdb+139EPSS score17.71%
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.CVE-2020-5421debianlibspring-java+41EPSS score11.56%
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.CVE-2020-10683chainguardeco-java-gradle-1.11+75EPSS score7.27%
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.CVE-2020-10969chainguardeco-java-gradle-4.10+61EPSS score3.56%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.CVE-2020-10672chainguardeco-java-gradle-4.10+61EPSS score3.06%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).CVE-2020-10968chainguardeco-java-gradle-4.10+61EPSS score3.66%
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).