Apex
Monthly
Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.
Apex versions up to 23.2.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle APEX Sample Appli (CVSS 5.4).
NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.39.X before 1.39.9, from. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Local privilege escalation of data access in Oracle APEX's Installation component allows a low-privileged OS user to read all data accessible to the APEX platform. Affected versions are 24.1, 24.2, and 26.1. Despite the 'Authentication Bypass' tag suggesting a control-plane weakness during or after installation, exploitation is constrained to attackers with an existing local logon to the host infrastructure - no public exploit identified at time of analysis and no CISA KEV listing.
Apex versions up to 23.2.0 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of Oracle APEX Sample Appli (CVSS 5.4).
NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.39.X before 1.39.9, from. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.