ApexSec Latest Release

ApexSec performs security scans of APEX applications from 3.x through to 23.2.

The latest release of ApexSec is 3.1.24, the following features and fixes have been implemented;

  • Fix for memory exhaustion when processing large APEX exports over 60Mb
  • Correct Compatibility mode correction for APEX 18.1
  • Correct Report Column scanning for APEX 18.1
  • Correct Public Page detection for APEX 18.1
  • Fix Project Merging where ‘null’ added to comments
  • Fix report output where APEX items have been moved or been deleted
  • Fix regression issue for import of APEX 4.x applications
  • Enable HTML output from the command line
  • Fix scanning error when only 1 CPU available
  • Display a reminder to user about license expiry
  • Enable correct handling of multiple monitors
  • Enable scanning of APEX 19.1 applications
  • Improve checking of AJAX dynamic actions
  • Do not report on Display Only items that cannot be protected
  • Fix for lookup of synonyms with variable case names
  • New detection of unprotected and un-escaped items for reflective XSS
  • New detection of usage of cryptographically weak random number generator code
  • Wrap long project names in home screen
  • Correct re-scan problem with projects saved from older version of ApexSec
  • Enable output of JUnit results from the GUI
  • Correct JUnit output where a pass and fail had the same test name
  • Add human readable item description to JUnit output
  • Populate password field on re-scan if password saved with project
  • Default set to scan packages to make GUI consistent with CLI
  • Correct command line help text for option to not scan packages

In the release of ApexSec is 3.1.23, the following features and fixes have been implemented;

  • Check for Java VM lower than 1.8
  • Autocomplete detection, clarify global page issues
  • Prevent false positive on on Frame Embedding detection when compatibility mode is set
  • Improve detection of SQL Injection for new ‘NATIVE_’ style reports
  • Clarify report text for Secure Cookies setting
  • Indicate ‘save status’ in tab when using Developer Comments
  • Remember position and status of Developer Comments on application close
  • Ensure global page items are correctly reported for the Page Autocomplete detection
  • Support for accessing multiple schemas when connecting and analysing from database connection
  • Prevent blank screen on project load on Red Hat Linux
  • Fix for ‘null’ error message when loading old projects which scan files
  • Fix for error when server is using self-signed certificates
  • Include ApexSec version on reports
  • Add Command Line option to print ApexSec version
  • Move ‘default’ apexsec.oracle.com scan URL to be https on first run
  • Correct dates on copyright notices
  • Correctly scan APEX export files that have had additional REM statements added at top of file
  • Update Code protection encryption library
  • Make on-disk preferences human readable and consistent across ApexSec versions
  • Prevent error where impossible to make functions and/or procedures ‘false positive’
  • Increase speed when importing files
  • Remove deleted APEX items from results
  • Change internal hashing mechanism to a faster algorithm
  • Prevent error when files are removed or added from ZIP file and re-scanned
  • Allow ‘false positive’ button to mark a whole vulnerability class in GUI
  • Correct error when database closes connection
  • Fixed error where ApexSec attempts lookup of code on closed database handle
  • If directory scan only contains one APEX export then scan without prompting
  • Fix for incorrect caching in temp directory when scanning ZIP files
  • Fix for error when scanning ZIP file containing invalid files

In the release of ApexSec 3.1.22, the following features and fixes have been implemented;

  • New APEX 5.1 compatibility to allow scanning of 5.1 APEX applications
  • New improved error handling for APEX 5.0 and APEX 5.1 when accessing APEX Builder
  • New detection of Cross-Site Scripting problems in APEX error messages
  • Fix to correctly identify function/procedure lookups where function contains default values
  • Fix to ignore built-in fuctions when performing code lookup via APEX builder improving speed
  • Fix to prevent thread locking and slow down when accessing application through APEX builder
  • Fix to improve Oracle 12c compatibility for create table and package syntax
  • Fix to prevent ‘HIDDEN’ APEX columns erroneously appearing in Cross-Site Scripting Checks
  • Fix to increase Timeout on HTTP requests to allow slow servers to respond
  • Fix incorrect highlighting of issues for ‘Direct URL’ plugin in SELECT statement
  • Fix spurious highlighting problem in APEX Interactive Report queries
  • Fix for occational application crash when analysing from APEX Builder
  • Fix for ‘File Handling’ plugin where only the first issue was highlighted
  • Fix for occasional endless loop when analysing ZIP file contents
  • Fix for Mac OS where renamed project file causes crash
  • Fix to ensure dbms.assert.encode_literal passes all SQL injection detection
  • Fix for crash when web server does not return all expected headers