apache log4j 2.0 vulnerabilities and exploits

(subscribe to this query)

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows malicious users to manipulate the SQL by ent...

Apache Log4j Netapp Snapmanager -Broadcom Brocade Sannav -Qos Reload4j Oracle Advanced Supply Chain Planning 12.1 Oracle Advanced Supply Chain Planning 12.2 Oracle Business Intelligence 5.9.0.0.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Business Process Management Suite 12.2.1.4.0 Oracle Communications Eagle Ftp Table Base Retrieval 4.5

2 Github repositories1 Article

Apache Log4j2 2.0-beta9 up to and including 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can contr...

Apache Log4j Apache Log4j 2.0 Siemens Sppa-t3000 Ses3000 Firmware Siemens Captial Siemens Captial 2019.1 Siemens Comos Siemens Desigo Cc Advanced Reports 4.0 Siemens Desigo Cc Advanced Reports 4.1 Siemens Desigo Cc Advanced Reports 4.2 Siemens Desigo Cc Advanced Reports 5.0 Siemens Desigo Cc Advanced Reports 5.1 Siemens Desigo Cc Info Center 5.0

2 Metasploit modules787 Github repositories29 Articles

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with...

Apache Log4j Apache Log4j 2.0 Cvat Computer Vision Annotation Tool -Intel Audio Development Kit -Intel Datacenter Manager -Intel Genomics Kernel Library -Intel Oneapi -Intel Secure Device Onboard -Intel Sensor Solution Firmware Development Kit -Intel System Debugger -Intel System Studio -Siemens Sppa-t3000 Ses3000 Firmware

122 Github repositories9 Articles

Apache Log4j2 versions 2.0-beta7 up to and including 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the tar...

Apache Log4j Apache Log4j 2.0 Oracle Communications Diameter Signaling Router Oracle Communications Interactive Session Recorder 6.3 Oracle Communications Interactive Session Recorder 6.4 Oracle Primavera Gateway Oracle Primavera Gateway 21.12.0 Oracle Primavera P6 Enterprise Project Portfolio Management Oracle Primavera P6 Enterprise Project Portfolio Management 21.12.0.0 Oracle Primavera Unifier 18.8 Oracle Primavera Unifier 19.12 Oracle Primavera Unifier 20.12

25 Github repositories4 Articles

Apache Log4j2 versions 2.0-alpha1 up to and including 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted strin...

Apache Log4j Netapp Cloud Manager -Debian Debian Linux 10.0 Debian Debian Linux 11.0 Sonicwall Email Security Sonicwall Network Security Manager Sonicwall Web Application Firewall Sonicwall 6bk1602-0aa12-0tp0 Firmware Sonicwall 6bk1602-0aa22-0tp0 Firmware Sonicwall 6bk1602-0aa32-0tp0 Firmware Sonicwall 6bk1602-0aa42-0tp0 Firmware Sonicwall 6bk1602-0aa52-0tp0 Firmware

49 Github repositories5 Articles

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook