# Oracle Retail Merchandising System


- [CVE-2022-22965](https://insights.sbomify.com/CVE-2022-22965/): Spring Framework JDK 9+ Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2018-14721](https://insights.sbomify.com/CVE-2018-14721/): Server-Side Request Forgery (SSRF) in jackson-databind (critical 10.0)
- [CVE-2020-5413](https://insights.sbomify.com/CVE-2020-5413/): Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (critical 9.8)
- [CVE-2020-9546](https://insights.sbomify.com/CVE-2020-9546/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2020-9548](https://insights.sbomify.com/CVE-2020-9548/): jackson-databind mishandles the interaction between serialization gadgets and typing (critical 9.8)
- [CVE-2019-20330](https://insights.sbomify.com/CVE-2019-20330/): Deserialization of Untrusted Data in jackson-databind (critical 9.8)
- [CVE-2019-17531](https://insights.sbomify.com/CVE-2019-17531/): jackson-databind polymorphic typing issue (critical 9.8)
- [CVE-2019-16942](https://insights.sbomify.com/CVE-2019-16942/): Polymorphic Typing in FasterXML jackson-databind (critical 9.8)
- [CVE-2019-16943](https://insights.sbomify.com/CVE-2019-16943/): jackson-databind polymorphic typing issue (critical 9.8)
- [CVE-2018-14718](https://insights.sbomify.com/CVE-2018-14718/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2018-14719](https://insights.sbomify.com/CVE-2018-14719/): Arbitrary Code Execution in jackson-databind (critical 9.8)
- [CVE-2018-14720](https://insights.sbomify.com/CVE-2018-14720/): XML External Entity Reference (XXE) in jackson-databind (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/oracle/retail-merchandising-system/