Retail Extract Transform And Load

Vendor:

First CVE: Apr 17, 2017 · Active for 9 years

11

Total CVEs

More Total CVEs than 90% of tracked products

2.2

Avg CVEs / Year

Higher CVE frequency than 76% of tracked products

7.6

Avg CVSS

Higher Avg CVSS than 64% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Retail Extract Transform And Load over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 17, 2017

9 years ago

Most Recent CVE

Jan 24, 2022

1,646 days ago

CVE Severity & Scoring

Retail Extract Transform And Load11 CVEs

45%

27%

All CVEs353,173 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local3 (27.3%)

Network8 (72.7%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low8 (72.7%)

High3 (27.3%)

Unknown0 (0.0%)

User Interaction

None6 (54.5%)

Unknown0 (0.0%)

Required5 (45.5%)

Privileges Required

Low3 (27.3%)

High0 (0.0%)

None8 (72.7%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (11 CVEs).

11 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2017-5645CRITICAL In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payloa	Apr 17, 2017	9.8	86	NO	YES
CVE-2019-17571CRITICAL Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a	Dec 20, 2019	9.8	72	NO	NO
CVE-2021-4104HIGH JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName	Dec 14, 2021	7.5	70	NO	NO
CVE-2022-23305CRITICAL By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message conv	Jan 18, 2022	9.8	68	NO	NO
CVE-2022-23307HIGH CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exi	Jan 18, 2022	8.8	57	NO	NO
CVE-2021-2351HIGH Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulne	Jul 21, 2021	8.3	28	NO	NO
CVE-2022-23437MEDIUM There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an	Jan 24, 2022	6.5	25	NO	NO
CVE-2019-10219MEDIUM A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments an	Nov 8, 2019	6.1	23	NO	NO
CVE-2021-36374MEDIUM When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even f	Jul 14, 2021	5.5	21	NO	NO
CVE-2021-36373MEDIUM When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs	Jul 14, 2021	5.5	21	NO	NO

View all 11 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (11 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

1 CVE

9.1% of CVEs· 97th percentile

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (11 CVEs).

Media Mentions

Signals from CVEs in this product scope (11 CVEs).

Top CNAs Publishing CVEs For Retail Extract Transform And Load

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
19.0	2	9.8	77.8%	1
13.2.8	6	6.4	2.7%	0
13.2.5	4	8.1	50.5%	0
13.2	1	9.8	89.0%	1
13.1	1	9.8	89.0%	1
13.0	1	9.8	89.0%	1