CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/clusterconfig/ endpoint. Graylog's cluster config system uses fully qualified class...

The vulnerability of the software for centralized logging, analysis, and storage of logs by Graylog, related to incorrect session duration settings, allows a hacker to intercept a user’s session.

The vulnerability of the Graylog log collection, analysis, and storage software lies in the incorrect duration of the session. Exploiting this vulnerability allows a remote attacker to intercept the user’s session...

Graylog 数据伪造问题漏洞

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing, and analyzing logs in real time, among other things. Graylog suffers from a data forgery issue vulnerability that stems from vulnerability to DNS cache poisoning attacks...