# Oracle Retail Customer Management and Segmentation Foundation


- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-5413](https://insights.sbomify.com/CVE-2020-5413/): Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (critical 9.8)
- [CVE-2020-10683](https://insights.sbomify.com/CVE-2020-10683/): dom4j allows External Entities by default which might enable XXE attacks (critical 9.8)
- [CVE-2020-2953](https://insights.sbomify.com/CVE-2020-2953/): Auth bypass in Retail Customer Management and Segmentation Foundation (critical 9.8)
- [CVE-2019-17267](https://insights.sbomify.com/CVE-2019-17267/): Improper Input Validation in jackson-databind (critical 9.8)
- [CVE-2019-14540](https://insights.sbomify.com/CVE-2019-14540/): Polymorphic Typing issue in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-16335](https://insights.sbomify.com/CVE-2019-16335/): Polymorphic Typing issue in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-14379](https://insights.sbomify.com/CVE-2019-14379/): Deserialization of untrusted data in FasterXML jackson-databind (critical 9.8)
- [CVE-2018-11307](https://insights.sbomify.com/CVE-2018-11307/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2019-3772](https://insights.sbomify.com/CVE-2019-3772/): Spring Integration XML External Entity Injection (XXE) (critical 9.8)
- [CVE-2018-14718](https://insights.sbomify.com/CVE-2018-14718/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2020-36179](https://insights.sbomify.com/CVE-2020-36179/): Unsafe Deserialization in jackson-databind (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/retail-customer-management-and-segmentation-foundation/