FreeBSD : graylog -- remote code execution in log4j from user-controlled log input (650734b2-7665-4170-9a0a-eeced5e10a5e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 650734b2-7665-4170-9a0a-eeced5e10a5e advisory. - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain...

FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3fadd7e4-f8fb-45a0-a218-8fd6423c338f advisory. - Apache Log4j2 2.10 this behavior can be mitigated by setting system property log4j2.formatMsgNoLookup...

graylog -- include log4j patches

Apache Software Foundation repos: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or paramters can execute arbitrary code from attacker-controller LDAP servers when message lookup substitution i...

Graylog permission permission and access control issue vulnerability (CNVD-2021-61088)

Graylog is a centralized log management solution from Graylog, Inc. The product supports capturing, storing, and analyzing logs in real-time, among other things. graylog suffers from a permission permission and access control issue vulnerability that stems from a session ID leak in audit logs pri...

Graylog Privilege Permission and Access Control Issues Vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog suffers from a privilege permission and access control issue vulnerability that stems from a session ID leak in the DEBUG log fil...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Session fixation

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Session fixation

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

Graylog prior to 4.1.2 is affected by a Session ID leak in the DEBUG log file that allows an attacker to escalate privileges to the leaked session ID. Affected product: Graylog (before 4.1.2). Root cause: leakage of session IDs via DEBUG logs. Impact: potential privilege elevation with the leaked...

CVE-2021-37760

CVE-2021-37760 affects Graylog prior to version 4.1.2. The vulnerability is a Session ID leak in the audit log that can enable an attacker to escalate privileges to the leaked session’s access level. The issue’s root cause is the exposure of session identifiers in audit logs, allowing escalation ...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Graylog 日志信息泄露漏洞

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog suffers from a privilege permission and access control issue vulnerability that stems from a session ID leak in the DEBUG log fil...

Graylog 日志信息泄露漏洞

Graylog is a centralized log management solution from Graylog, Inc. The product supports capturing, storing, and analyzing logs in real-time, among other things. graylog suffers from a permission permission and access control issue vulnerability that stems from a session ID leak in audit logs pri...

Cross-Site Scripting in graylog-web-interface

All versions of graylog-web-interface are vulnerable to Cross-Site Scripting XSS. The package fails to escape output on the TypeAhead and QueryInput components, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation No fix is currently available. Conside...