log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map MDC input data can craft malicious input data that contains a recursive lookup and can cause Denial of...

log4j-core: DoS in log4j 2.x with Thread Context Map (MDC) input data contains a recursive lookup and context lookup pattern

A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map MDC input data can craft malicious input data that contains a recursive lookup and can cause Denial of...

CVE-2021-44530

An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier Log4J CVE-2021-44228 allows a malicious actor to control the application...

Exploit for Improper Input Validation in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This is a Java project for a web application that uses the Log4j library. The project is a practice environment for testing and learning about the Log4j vulnerability CVE-2021-44228. The project includes a Maven project settings file, a Java class file, and a Log4j configuration file. The Log4j...

Apache OFBiz Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheofbizlog4shell.nbin...

Our Journey to Detect Log4j-Vulnerable Machines

Log4Shell CVE-2021-44228 is a remote code execution RCE vulnerability in the Apache-foundation open-source logging library Log4j. It was published on December 9, 2021, and then all hell broke loose. As Log4j is a common logging library for Java applications, it is highly widespread...

Is Ivanti IPCM voice vulnerable to CVE-2021-44228 Java logging library (log4j)

Created Date Dec 20, 2021 2:55:48 PM...

Apache Log4j security vulnerability

Log4j is an open source project of Apache , through the use of Log4j, you can control the destination of the log message delivery is the console , files , GUI components , and even sets of interfaces servers , NT's event logger and so on. A denial of service vulnerability exists in Apache Log4j2...

HPESBGN04218 rev.2 - HPE 3PAR/Primera StoreServ Management Console (SSMC), Apache Log4j 2 Remote Arbitrary Code Execution

Potential Security Impact: Remote: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreServ Management Console SSMC -Prior to v3.8.2.1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-44228 |...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

PoC exploit for CVE-2021-44228, a vulnerability in the Log4j Java library. The target product/service is Log4j, a Java logging library, and the vulnerability class/vector is a Remote Code Execution RCE vulnerability. The probable entry point is the "sendDetectionRequest" function in the...

Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021

Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against...

Facebook WhatsApp for iOS logging library resource management error vulnerability

Facebook WhatsApp is a suite of mobile applications from the American company Facebook that utilize the web to deliver text messages. The application uses the contact information in a smartphone to find contacts using the software to send texts, pictures, etc. A security vulnerability exists in t...

CVE-2020-1909

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including...

Memory corruption

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including...

CVE-2020-1909

CVE-2020-1909 involves a use-after-free in the logging library used by WhatsApp for iOS (and WhatsApp Business for iOS) prior to version 2.20.111. The underlying issue can cause memory corruption and crashes, with a potential for code execution when a specific sequence of events occurs (notably r...

PT-2020-15163

Name of the Vulnerable Software and Affected Versions WhatsApp for iOS versions prior to 2.20.111 WhatsApp Business for iOS versions prior to 2.20.111 Description A use-after-free issue in the logging library could result in memory corruption, crashes, and potentially code execution. This issue...

CVE-2020-1909: Use After Free

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including...