Oracle Primavera Gateway (Jul 2020 CPU)

The 16.2.0-16.2.11, 17.12.0-17.12.7, 18.8.0-18.8.9, and 19.12.0-19.12.4 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and...

Low: Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 3.9.1 security update

An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

ai.eto:rikai_2.12 (>=0.0.2 <=0.0.12), at.willhaben.willtest:core (=3.1.1) +774 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.13.0 <=2.13.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.13.0, =0.0.2, =2.0, =1.4.5, =1.4.5, =1.4.6, =00.01.02, =00.00.01, =00.02.29, =01.01.05 and more Source cves: CVE-2020-9488 Source advisory: OSV:GHSA-VWQQ-5VRC-XW9H...

org.apache.james:james-server-app (=3.5.0), org.apache.james:james-server-spring (=3.5.0) potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j (=2.13.1)

org.apache.logging.log4j:log4j MAVEN version =2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j and may be impacted: - org.apache.james:james-server-app =3.5.0 - org.apache.james:james-server-spring =3.5.0 Source cve...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1 <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0 <=0.1.1) +22382 more potentially affected by CVE-2020-9488 via org.apache.logging.log4j:log4j-core (>=2.0 <=2.3.1)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.8 and more Source cves: CVE-2020-9488 Source advisory: OSV:GHSA-VWQQ-5VRC-XW9H...

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

The vulnerability of the Log4j Java logging library, related to the restoration of unreliable data in memory, allows a hacker to execute arbitrary code.

The vulnerability of the Log4j logging library in Java programs involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

[SECURITY] Fedora 30 Update: log4net-2.0.8-10.fc30

log4net is a tool to help the programmer output log statements to a variety of output targets. log4net is a port of the excellent log4j framework to the .NET runtime...

Apache Log4j < 2.13.2 Improper Certificate Verification

The version of Apache Log4j on the remote host is 2.13.2. It is, therefore, affected by an improper certificate validation vulnerability in the log4j SMTP appender. An attacker could leverage this vulnerability to perform a man-in-the-middle attack. Note that Nessus has not tested for these issue...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 Mitigation Previous...

jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the log4j-extra gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

Moderate: Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Improper Validation Of Certificate

log4j-core is vulnerable to improper validation of certificate. It does not not verify the host name against the SSL/TLS certificate of an SMTPS connection during the certificate validation, allowing a man-in-the-middle to intercept the log messages sent...

Apache Log4j Trust Management Issues Vulnerability

Apache Log4j is the United States Apache Apache Software Foundation of a Java-based open source logging tools. A security vulnerability exists in Apache Log4j that stems from SmtpAppender's failure to verify that the host name matches the SSL/TLS certificate of an SMTPS connection. An attacker ca...

Man-in-the-Middle (MitM)

Overview slyphon-log4j is a log4j jar file in a gem. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attac...

Man-in-the-Middle (MitM)

Overview log4j-jars is a ruby bundled Log4j jars. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

DEBIAN-CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...