Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

apache log4j vulnerabilities and exploits

(subscribe to this query)
7.5
CVSSv3

CVE-2023-26464

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component...
Apache Log4j
6.8
CVSSv2

CVE-2020-9493

A deserialization flaw was found in Apache Chainsaw versions before 2.1.0 which could lead to malicious code execution.
Apache ChainsawApache Log4jQos Reload4j
7.5
CVSSv2

CVE-2019-17571

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j...
Apache Log4jDebian Debian Linux 8.0Debian Debian Linux 9.0Debian Debian Linux 10.0Canonical Ubuntu Linux 18.04Opensuse Leap 15.1Netapp Oncommand System ManagerNetapp Oncommand Workflow Automation -Oracle Application Testing Suite 13.3.0.1Oracle Communications Network IntegrityOracle Endeca Information Discovery Studio 3.2.0Oracle Financial Services Lending And Leasing
9
CVSSv2

CVE-2022-23307

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
Apache ChainsawApache Log4jQos Reload4jOracle Advanced Supply Chain Planning 12.1Oracle Advanced Supply Chain Planning 12.2Oracle Business Intelligence 5.9.0.0.0Oracle Business Intelligence 12.2.1.3.0Oracle Business Intelligence 12.2.1.4.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 12.2.1.4.0Oracle Communications Eagle Ftp Table Base Retrieval 4.5Oracle Communications Instant Messaging Server 10.0.1.5.0
6
CVSSv2

CVE-2022-23302

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBi...
Apache Log4jNetapp Snapmanager -Broadcom Brocade Sannav -Qos Reload4jOracle Advanced Supply Chain Planning 12.1Oracle Advanced Supply Chain Planning 12.2Oracle Business Intelligence 5.9.0.0.0Oracle Business Intelligence 12.2.1.3.0Oracle Business Intelligence 12.2.1.4.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 12.2.1.4.0Oracle Communications Eagle Ftp Table Base Retrieval 4.5
6.8
CVSSv2

CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows malicious users to manipulate the SQL by ent...
Apache Log4jNetapp Snapmanager -Broadcom Brocade Sannav -Qos Reload4jOracle Advanced Supply Chain Planning 12.1Oracle Advanced Supply Chain Planning 12.2Oracle Business Intelligence 5.9.0.0.0Oracle Business Intelligence 12.2.1.3.0Oracle Business Intelligence 12.2.1.4.0Oracle Business Process Management Suite 12.2.1.3.0Oracle Business Process Management Suite 12.2.1.4.0Oracle Communications Eagle Ftp Table Base Retrieval 4.5
7.2
CVSSv2

CVE-2021-3100

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
Amazon Log4jhotpatch
7.2
CVSSv2

CVE-2022-0070

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.
Amazon Log4jhotpatch
6
CVSSv2

CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests t...
Apache Log4j 1.2Fedoraproject Fedora 35Redhat Codeready Studio 12.0Redhat Integration Camel K -Redhat Integration Camel Quarkus -Redhat Jboss A-mq 6.0.0Redhat Jboss A-mq 7Redhat Jboss A-mq Streaming -Redhat Jboss Data Grid 7.0.0Redhat Jboss Data Virtualization 6.0.0Redhat Jboss Enterprise Application Platform 6.0.0Redhat Jboss Enterprise Application Platform 7.0
4.3
CVSSv2

CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 up to and including 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted strin...
Apache Log4jNetapp Cloud Manager -Debian Debian Linux 10.0Debian Debian Linux 11.0Sonicwall Email SecuritySonicwall Network Security ManagerSonicwall Web Application FirewallSonicwall 6bk1602-0aa12-0tp0 FirmwareSonicwall 6bk1602-0aa22-0tp0 FirmwareSonicwall 6bk1602-0aa32-0tp0 FirmwareSonicwall 6bk1602-0aa42-0tp0 FirmwareSonicwall 6bk1602-0aa52-0tp0 Firmware
Preferred Score:
CVSSv2
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2025-21317CVE-2025-23940buffer overflowCVE-2025-21335CVE-2025-23860CVE-2024-57704SSTIwirelessCVE-2019-3309
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook