qos reload4j vulnerabilities and exploits

(subscribe to this query)

A deserialization flaw was found in Apache Chainsaw versions before 2.1.0 which could lead to malicious code execution.

Apache Chainsaw Apache Log4j Qos Reload4j

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Apache Chainsaw Apache Log4j Qos Reload4j Oracle Advanced Supply Chain Planning 12.1 Oracle Advanced Supply Chain Planning 12.2 Oracle Business Intelligence 5.9.0.0.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.2.1.4.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5 Oracle Communications Instant Messaging Server 10.0.1.5.0

1 Github repository1 Article

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBi...

Apache Log4j Netapp Snapmanager -Broadcom Brocade Sannav -Qos Reload4j Oracle Advanced Supply Chain Planning 12.1 Oracle Advanced Supply Chain Planning 12.2 Oracle Business Intelligence 5.9.0.0.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.2.1.4.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5

2 Articles

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows malicious users to manipulate the SQL by ent...

Apache Log4j Netapp Snapmanager -Broadcom Brocade Sannav -Qos Reload4j Oracle Advanced Supply Chain Planning 12.1 Oracle Advanced Supply Chain Planning 12.2 Oracle Business Intelligence 5.9.0.0.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.2.1.4.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5

2 Github repositories1 Article

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Apache Log4j Oracle Communications Application Session Controller 3.9m0p1 Oracle Communications Billing And Revenue Management 7.5.0.23.0 Oracle Communications Billing And Revenue Management 12.0.0.3.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5 Oracle Communications Offline Mediation Controller 12.0.0.3.0 Oracle Communications Services Gatekeeper 7.0 Oracle Communications Unified Inventory Management 7.3.0 Oracle Communications Unified Inventory Management 7.4.0 Oracle Data Integrator 12.2.1.3.0 Oracle Data Integrator 12.2.1.4.0 Oracle Enterprise Manager For Peoplesoft 13.4.1.1

1 Github repository1 Article

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook