Retail Xstore Point Of Service vulnerabilities
5 known vulnerabilities in Retail Xstore Point Of Service from Oracle. 5 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
Spring Framework JDK 9+ Remote Code Execution Exploited
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot
- 9.8 Critical severity
VMware Tanzu Spring Cloud Function Remote Code Execution Exploited
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local r
- 8.5 High severity
XStream Remote Code Execution Exploited
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affect
- 7.8 High severity
Apache HTTP Server Privilege Escalation Exploited
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privi
- 8.1 High severity
Apache Tomcat Remote Code Execution Exploited
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file