High WID-SEC-2026-0166 6 CVEs

Oracle Retail Applications: Mehrere Schwachstellen

Published Jan 20, 2026 · Updated Jan 20, 2026 · de-DE

Vendor: Oracle Product: Retail Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Retail Applications ist eine Sammlung von Produkten zur Unterstützung u. a. von Handelsfirmen und der Gastronomie.

Vulnerabilities 6

High 8.8

CVE-2025-48734 Public exploit

Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven

May 28, 2025
High 7.5

CVE-2025-41249 Public exploit

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions…

VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Sep 16, 2025
Medium 6.0

CVE-2025-7962

Jakarta Mail vulnerable to SMTP Injection

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Eclipse Foundation Jakarta Mail thingsboard-tb-node apache-nifi Debian Ubuntu Wolfi Maven

Jul 21, 2025
Medium 5.9

CVE-2025-26333

Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated…

Dell BSAFE Crypto-J

Sep 25, 2025
Medium 5.3

CVE-2025-48924 Public exploit

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

Jul 11, 2025
Medium 5.3

CVE-2025-61795

Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but lef…

Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Oct 27, 2025

Revision history

2026-01-20 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle Retail Applications vom 2026-01-20
https://www.oracle.com/security-alerts/cpujan2026.html#AppendixRAPP