Oracle Application Express vulnerabilities
47 known vulnerabilities affecting oracle/application_express.
Total CVEs
47
CISA KEV
1
actively exploited
Public exploits
2
Exploited in wild
2
Severity breakdown
CRITICAL4HIGH2MEDIUM41
Vulnerabilities
Page 3 of 3
CVE-2019-11358MEDIUMCVSS 6.1ExploitedPoCfixed in 19.12019-04-20
CVE-2019-11358 [MEDIUM] CWE-1321 CVE-2019-11358: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(t
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
nvd
CVE-2018-2699MEDIUMCVSS 6.1≤ 5.1.4.00.082018-01-18
CVE-2018-2699 [MEDIUM] CVE-2018-2699: Vulnerability in the Application Express component of Oracle Database Server. The supported version
Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.1.4.00.08. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require human interaction from a person other than the attacker and whil
nvd
CVE-2016-7103MEDIUMCVSS 6.1fixed in 19.12017-03-15
CVE-2016-7103 [MEDIUM] CWE-79 CVE-2016-7103: Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
nvd
CVE-2016-3448MEDIUMCVSS 6.1≤ 5.0.32016-07-21
CVE-2016-3448 [MEDIUM] CVE-2016-3448: Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.
Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect confidentiality and integrity via unknown vectors.
nvd
CVE-2016-3467MEDIUMCVSS 5.8≤ 5.0.32016-07-21
CVE-2016-3467 [MEDIUM] CVE-2016-3467: Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.
Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect availability via unknown vectors.
nvd
CVE-2008-1822CRITICALCVSS 10.0v3.0.12008-04-16
CVE-2008-1822 [CRITICAL] CVE-2008-1822: Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express
Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02.
nvd
CVE-2008-1811MEDIUMCVSS 5.5v3.0.12008-04-16
CVE-2008-1811 [MEDIUM] CVE-2008-1811: Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote auth
Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka APEX01. NOTE: the previous information was obtained from the April 2008 CPU. Oracle has not commented on reliable researcher claims that APEX01 is for insufficient authorization checks
nvd
← Previous3 / 3