Product:

Retail_xstore_point_of_service

(Oracle)
Repositories https://github.com/bcgit/bc-java
#Vulnerabilities 46
Date Id Summary Products Score Patch Annotated
2020-09-19 CVE-2020-5421 In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. Ambari, Hive, Oncommand_insight, Snap_creator_framework, Snapcenter, Communications_brm, Communications_session_report_manager, Communications_unified_inventory_management, Endeca_information_discovery_integrator, Enterprise_data_quality, Financial_services_analytical_applications_infrastructure, Flexcube_private_banking, Fusion_middleware, Goldengate_application_adapters, Healthcare_master_person_index, Hyperion_infrastructure_technology, Insurance_policy_administration, Insurance_rules_palette, Mysql_enterprise_monitor, Primavera_gateway, Primavera_p6_enterprise_project_portfolio_management, Retail_assortment_planning, Retail_bulk_data_integration, Retail_customer_engagement, Retail_customer_management_and_segmentation_foundation, Retail_financial_integration, Retail_integration_bus, Retail_invoice_matching, Retail_merchandising_system, Retail_order_broker, Retail_predictive_application_server, Retail_returns_management, Retail_service_backbone, Retail_xstore_point_of_service, Storagetek_tape_analytics_sw_tool, Weblogic_server, Spring_framework 6.5
2020-05-01 CVE-2020-10683 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j. Ubuntu_linux, Dom4j, Oncommand_api_services, Oncommand_workflow_automation, Snap_creator_framework, Snapcenter, Snapmanager, Leap, Agile_plm, Application_testing_suite, Banking_platform, Business_process_management_suite, Communications_application_session_controller, Communications_diameter_signaling_router, Communications_unified_inventory_management, Data_integrator, Endeca_information_discovery_integrator, Enterprise_data_quality, Enterprise_manager_base_platform, Financial_services_analytical_applications_infrastructure, Fusion_middleware, Health_sciences_empirica_signal, Health_sciences_information_manager, Jdeveloper, Primavera_p6_enterprise_project_portfolio_management, Rapid_planning, Retail_customer_management_and_segmentation_foundation, Retail_integration_bus, Retail_order_broker, Retail_price_management, Retail_xstore_point_of_service, Storagetek_tape_analytics_sw_tool, Utilities_framework, Webcenter_portal 9.8
2019-08-20 CVE-2019-10086 In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. Commons_beanutils, Nifi, Debian_linux, Fedora, Leap, Agile_plm, Agile_product_lifecycle_management_integration_pack, Application_testing_suite, Banking_platform, Communications_billing_and_revenue_management_elastic_charging_engine, Communications_cloud_native_core_console, Communications_cloud_native_core_policy, Communications_cloud_native_core_unified_data_repository, Communications_evolved_communications_application_server, Communications_metasolv_solution, Communications_performance_intelligence_center, Communications_pricing_design_center, Communications_unified_inventory_management, Customer_management_and_segmentation_foundation, Enterprise_manager_for_virtualization, Financial_services_revenue_management_and_billing_analytics, Flexcube_private_banking, Fusion_middleware, Healthcare_foundation, Hospitality_opera_5, Insurance_data_gateway, Jd_edwards_enterpriseone_orchestrator, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools, Peoplesoft_enterprise_pt_peopletools, Primavera_gateway, Real\-Time_decisions_solutions, Retail_advanced_inventory_planning, Retail_back_office, Retail_central_office, Retail_merchandising_system, Retail_point\-Of\-Service, Retail_predictive_application_server, Retail_price_management, Retail_returns_management, Retail_xstore_point_of_service, Service_bus, Solaris_cluster, Utilities_framework, Weblogic_server, Enterprise_linux_desktop, Enterprise_linux_eus, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_tus, Enterprise_linux_workstation, Jboss_enterprise_application_platform 7.3
2018-04-26 CVE-2018-10237 Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. Guava, Banking_payments, Communications_ip_service_activator, Customer_management_and_segmentation_foundation, Database_server, Flexcube_investor_servicing, Flexcube_private_banking, Retail_integration_bus, Retail_xstore_point_of_service, Weblogic_server, Jboss_enterprise_application_platform, Openshift_container_platform, Openstack, Satellite, Satellite_capsule, Virtualization, Virtualization_host 5.9
2019-04-22 CVE-2019-10247 In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error,... Jetty, Element, Oncommand_system_manager, Snap_creator_framework, Snapcenter, Snapmanager, Storage_replication_adapter_for_clustered_data_ontap, Storage_services_connector, Vasa_provider_for_clustered_data_ontap, Virtual_storage_console, Autovue, Communications_analytics, Communications_element_manager, Communications_services_gatekeeper, Communications_session_report_manager, Communications_session_route_manager, Data_integrator, Endeca_information_discovery_integrator, Enterprise_manager_base_platform, Flexcube_core_banking, Flexcube_private_banking, Hospitality_guest_access, Retail_xstore_point_of_service, Unified_directory 5.3
2018-06-26 CVE-2017-7657 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary... Debian_linux, Jetty, Xp_p9000_command_view, E\-Series_santricity_management, E\-Series_santricity_os_controller, E\-Series_santricity_web_services, Element_software, Element_software_management_node, Hci_storage_nodes, Oncommand_system_manager, Oncommand_unified_manager, Santricity_cloud_connector, Snap_creator_framework, Snapcenter, Snapmanager, Rest_data_services, Retail_xstore_point_of_service 9.8
2018-06-26 CVE-2017-7658 In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the... Debian_linux, Jetty, Xp_p9000_command_view, E\-Series_santricity_management, E\-Series_santricity_os_controller, E\-Series_santricity_web_services, Hci_management_node, Hci_storage_node, Oncommand_system_manager, Oncommand_unified_manager_for_7\-Mode, Santricity_cloud_connector, Snap_creator_framework, Snapcenter, Snapmanager, Solidfire, Storage_services_connector, Rest_data_services, Retail_xstore_payment, Retail_xstore_point_of_service 9.8
2019-01-30 CVE-2019-0190 A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts. Http_server, Enterprise_manager_ops_center, Hospitality_guest_access, Instantis_enterprisetrack, Retail_xstore_point_of_service 7.5
2019-07-23 CVE-2019-10173 It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) Banking_platform, Business_activity_monitoring, Communications_billing_and_revenue_management_elastic_charging_engine, Communications_diameter_signaling_router, Communications_unified_inventory_management, Endeca_information_discovery_studio, Retail_xstore_point_of_service, Utilities_framework, Webcenter_portal, Xstream 9.8
2020-01-03 CVE-2019-20330 FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. Debian_linux, Jackson\-Databind, Active_iq_unified_manager, Oncommand_api_services, Service_level_manager, Snapcenter, Steelstore_cloud_integrated_storage, Banking_platform, Communications_billing_and_revenue_management, Communications_contacts_server, Communications_evolved_communications_application_server, Communications_instant_messaging_server, Communications_network_charging_and_control, Customer_management_and_segmentation_foundation, Enterprise_manager_base_platform, Global_lifecycle_management_opatch, Goldengate_application_adapters, Goldengate_stream_analytics, Jd_edwards_enterpriseone_orchestrator, Jd_edwards_enterpriseone_tools, Primavera_unifier, Retail_merchandising_system, Retail_sales_audit, Retail_xstore_point_of_service, Siebel_engineering_\-_installer_\&_deployment, Siebel_ui_framework, Trace_file_analyzer, Webcenter_portal, Weblogic_server 9.8