HPESBGN04224 rev.1 - HPE Real Time Management System (RTMS), Apache Log4j 2 Remote Arbitrary Code Execution, Remote Code Execution, and Remote Denial of Service

Potential Security Impact: Remote: Arbitrary Code Execution, Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Real Time Management System RTMS - Prior to RTMS 3.00.72.1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | |...

RHEL 6 / 7 : log4j (RHSA-2021:5206)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:5206 advisory. Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: log4j: Remote code execution in Log4...

Exploit for Improper Input Validation in Apache Log4J

tejas-nagchandi/CVE-2021-45105 Replicating CVE-2021-45105...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4shell-rmi-poc A Proof of Concept of the Log4j vulnerabilit...

USN-5203-1: Apache Log4j 2 vulnerability

Hideki Okamoto and Guy Lederfein discovered that Apache Log4j 2 did not protect against infinite recursion in lookup evaluation. A remote attacker could possibly use this issue to cause Apache Log4j 2 to crash, leading to a denial of service. Please see the following link for more information:...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4jCenter Exploiting CVE-2021-44228 in vCenter for remote c...

MGASA-2021-0566 Updated log4j packages fix security vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern Layout with either a Context...

Updated log4j packages fix security vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern Layout with either a Context...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell in action This project aims to demonstrate how the...

Acronis: [forum.acronis.com] JNDI Code Injection due an outdated log4j component

Vulnerability description not provided...

Exploit for Deserialization of Untrusted Data in Apache Log4J

This is a proof-of-concept PoC exploit for CVE-2021-44228, a v...

Apache Log4j StrSubstitutor Uncontrolled Recursion Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Apache Log4j. Authentication is not required to exploit this vulnerability. The specific flaw exists within the StrSubstitutor class. The issue results from the lack of proper validatio...

Ubuntu 20.04 LTS : Apache Log4j 2 vulnerability (USN-5203-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5203-1 advisory. Hideki Okamoto and Guy Lederfein discovered that Apache Log4j 2 did not protect against infinite recursion in lookup evaluation. A remote attacker could possibly...

UBUNTU-CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue wa...

Security Bulletin: Apache Log4j Vulnerability Affects IBM Sterling Connect:Direct Web Services (CVE-2021-44228)

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Sterling Connect:Direct Web Services. This affects IBM Sterling Connect:Direct Web Services. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allo...

Denial Of Service (DoS)

log4j is vulnerable to denial of service. An attacker with control over Thread Context Map MDC input data is able to cause a denial of service by causing a StackOverflowError that will terminate the process. This is due to uncontrolled recursion from self-referential lookups when the logging...

ai.apiverse:apipulse (>='1.0.3' <=1.0.20), ai.eto:rikai_2.12 (>=0.0.2 <=0.0.13) +5545 more potentially affected by CVE-2021-45105 via org.apache.logging.log4j:log4j-core (>=2.13.0 <=2.16.0)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, ='1.0.3', =0.0.2, =2.1.0, =3.32.1.7, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =0.2.3, =0.2.4 and more Source cves: CVE-2021-45105 Source advisory: OSV:GHSA-P6XC-XR62-6R2G...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1 <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0 <=0.1.1) +22381 more potentially affected by CVE-2021-45105 via org.apache.logging.log4j:log4j-core (>=2.0 <=2.3)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.8 and more Source cves: CVE-2021-45105 Source advisory: OSV:GHSA-P6XC-XR62-6R2G...

Security Bulletin: IBM Sterling Configure, Price, Quote uses Apache Log4j 2.x which is subject to CVE-2021-44228.

Summary IBM Sterling Configure, Price, Quote uses Apache Log4j to log messages. Log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote...

Conti Ransomware Group Exploiting Log4j Vulnerability

By Deeba Ahmed These attacks started on December 13 in which the group focused on targeting VMWare vCenter servers. This is a post from HackRead.com Read the original post: Conti Ransomware Group Exploiting Log4j Vulnerability...