Oracle Retail Extract Transform 13.2.5

SQL injection in JDBC Appender in Apache Log4j V1

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.