log4j-shell-poc

log4j-shell-poc Una prueba de concepto para la vulnerabilidad CVE-2021-44228 descubierta recientemente. Recientemente se descubrió una nueva vulnerabilidad en log4j, una biblioteca de registro de Java muy utilizada en proyectos como Elasticsearch, Minecraft y muchos otros. En este repositorio hem...

log4j2-vuln-lab

⚠️ Disclaimer : This project is intended for security learning and technical research only. All vulnerability environments are set up locally, and no real targets have been tested. Do not use it for illegal purposes. The risk of using this project is borne by the user. Log4j2 Vulnerability...

log4shell-mitigation

Details and Mitigation Strategy for log4j2 RCE Vulnerability Visit this Youtube video for additional details. https://youtu.be/jqWdwTeGRK0 This is a quick post on the mitigation for CVE-2021-44228 Security Vulnerability aka Log4Shell and LogJam found in log4j2 Disclaimer All the information and...

log4j2

log4j2 esta es una demo de ataque log4j2 jmi, inspirada por enlace...

log4j-CVE-2021-44228

Apache Log4j Zero Day aka Log4Shell aka CVE-2021-44228 Introduction Reproducing the problem in k8s env Setting up k8s env with the vulnerability Possible Solutions KubeArmor Security Policy Not allowing any execs from the JVM/Java Default Deny based rules KubeArmor Visibility/Observability into t...

how-to-check-patch-secure-log4j-CVE-2021-44228

Cómo comprobar log4j CVE-2021-44228 ¿Qué es log4j ? LOG4J es un software Apache de código abierto basado en Java utilizado para servicios de registro. ¿Qué es la vulnerabilidad log4j CVE-2021-44228 ? La vulnerabilidad Log4j permite la ejecución remota de código con solo escribir una cadena...

CVE-2019-17571

CVE-2019-17571/Apache Log4j 1.2.X存在反序列化远程代码执行漏洞 漏洞预警参考链接： https://mp.weixin.qq.com/s/okU2y0izfnKXXtXG3EfLkQ 1. 漏洞描述 Apache Log4j是美国阿帕奇（Apache）软件基金会的一款基于Java的开源日志记录工具.Apache Log4j 1.2.X系列版本中存在反序列化远程代码执行漏洞.攻击者可利用该漏洞执行任意恶意命令.在Log4j...

Log4Shell-CVE-2021-44228-Demo

CVE-2021–44228 Demo 1. Introducción a CVE-2021–44228 La noticia más grande en el mundo de la ciberseguridad a finales de 2021 fue la vulnerabilidad de Log4j, numerada como CVE-2021-44228, también conocida como Log4Shell. Fue clasificada con la puntuación máxima de gravedad de 10 en el sistema de...

CVE-2021-44228

CVE-2021-44228 Apache Log4j 是一个用 Java 编写的日志记录工具。本文重点介绍 Log4j 和 log4shell 漏洞是什么、它是如何工作的、如何影响受害者，以及如何缓解该漏洞。 下载PDF并享受吧！！！干杯！！！...

CVE-2021-44228

🛡️ CVE-2021-44228: Log4Shell 分析 - 颠覆 Java 安全的漏洞 关键影响 CVSS 10.0 | 发现于2021年，Apache Log4j 中的这一缺陷允许远程代码执行 RCE，影响全球数百万系统。即使在今天，它仍然是网络安全领域的关键警示！ 🔍 什么是 Log4Shell？ CVE-2021-44228 ，被称为 Log4Shell ，是 Apache Log4j 2 日志库中的一个 远程代码执行 RCE 关键漏洞。该缺陷允许恶意攻击者仅通过发送应用程序记录的特制文本字符串，即可在易受攻击的服务器上执行任意代码。 为何如此危险？ Log4j 在 Java...

Astra Linux – Vulnerability in libpgjava

In pgjdbc before version 42.3.3, an attacker who controls the jdbc URL or properties can use java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example scenario is that an attacker could create a executable JSP file under a...

CLSA-2026-1787726168 TuxCare security update for org.apache.logging.log4j (4 CVEs)

TuxCare rebuilt 30 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2...

Unity Linux 20.1070e Security Update: springframework (UTSA-2026-016702)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016702 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

EUVD-2002-0968

Malware in sbrugna...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

PoC exploit for CVE-2021-44228, a Java logging library vulnerability. The target product/service is Apache Log4j, a Java logging library. The vulnerability class/vector is RCE Remote Code Execution via JNDI Java Naming and Directory Interface lookup. The probable entry points are JNDI lookups...

Apache Log4j 安全漏洞

Apache Log4j is a Java-based open source logging tool from the Apache USA Foundation. A security vulnerability exists in Apache Log4j version 1.2 that stems from untrusted data deserialization...

Amazon Linux 2022 : log4j, log4j-jcl, log4j-slf4j (ALAS2022-2021-003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-003 advisory. A flaw was found in the Java logging library Apache Log4j 2 in versions from 2.0-beta9 and before and including 2.14.1. This could allow a remote attacker to execute code on the server if the system log...

Apache Log4j: Multiple Vulnerabilities

Background Log4j is a Java logging framework that supports various use cases with a rich set of components, a separate API, and a performance-optimized implementation. Description Multiple vulnerabilities hav been discovered in Apache Log4j. Please review the CVE identifiers referenced below for...

Important: log4j

Issue Overview: A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests...

SUSE CVE-2023-26464

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...