Vulnerabilidades do Oracle Retail Point-of-service

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Ao executar o Apache Tomcat nas versões 9.0.0.M1 a 9.0.0, 8.5.0 a 8.5.22, 8.0.0.RC1 a 8.0.46 e 7.0.0 a 7.0.81 com HTTP PUT habilitado (por exemplo, definindo o parâmetro de inicialização readonly do servlet Default como false), era possível enviar um arquivo JSP ao servidor por meio de uma requisição especialmente criada. Esse JSP podia então ser requisitado, e qualquer código nele contido era executado pelo servidor.