log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

How to Buy Precious Patching Time as Log4j Exploits Fly

Sure, Apache got a patch out fast when the Log4j logging library vulnerability – aka Javageddon or “up there with Shellshock” – exploded last week. But emergency patches take days best-case scenario or weeks to install: plenty of time for attackers to do their worst. Which they lickety-split did,...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value

A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...

kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

A flaw was found in kubernetes. In Kubernetes, if the logging level is to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. Previously, CVE-2019-11250 was assigned for the same issue for logging...

CVE-2021-24756

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

nse-log4shell Nmap NSE scripts to check against log4shell or...

Improper Access Control in bookstackapp/bookstack

Description A logged-in user with no privileges OR guest user if public access enabled can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user...

CVE-2021-37861

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

CVE-2021-37861

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

CVE-2021-37861

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

Default credentials

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

CVE-2021-37861

Mattermost 6.0.2 and earlier: a vulnerability where passwords are not sufficiently sanitized in audit logs when user creation fails. Root cause is inadequate cleaning of the user’s password in audit logs, potentially exposing sensitive credentials in logs. The available documents do not specify a...

CVE-2021-37861

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

Mattermost 日志信息泄露漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a logging information disclosure vulnerability that stems from the software's failure to adequately clean up the user's password in the audit log when the user fails to create, which could be...

CVE-2021-41090

Grafana Agent prior to versions 0.20.1 and 0.21.2 exposed inline secrets in plaintext via endpoints ./-/config and /agent/api/v1/configs/:key, enabling potential information disclosure if the endpoint is reachable without HTTPS client auth. The issue affects metrics/secret configurations used for...

CVE-2021-41309

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

CVE-2021-41309

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

Authentication flaw

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

CVE-2021-41309

The CVE-2021-41309 issue affects Atlassian Jira Server and Data Center (pre-8.19.1) and is due to a Broken Authentication flaw in the /plugins/servlet/audit/resource endpoint. A user whose Jira Service Management access has been revoked can export audit logs from another user’s project. Reported ...