log4j2

log4j2 esta es una demo de ataque log4j2 jmi, inspirada por enlace...

log4j-CVE-2021-44228

Apache Log4j Día Cero aka Log4Shell aka CVE-2021-44228 Introducción Reproduciendo el problema en entorno k8s Configurando el entorno k8s con la vulnerabilidad Posibles Soluciones Política de Seguridad de KubeArmor No permitir ejecuciones desde JVM/Java Reglas basadas en denegación por defecto...

log4j-shell-poc

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java logging library that is very widely used in the likes of elasticsearch, minecraft and numerous others. In this repository we have made and example...

log4j2-vuln-lab

⚠️ Disclaimer : This project is intended for security learning and technical research only. All vulnerability environments are set up locally, and no real targets have been tested. Do not use it for illegal purposes. The risk of using this project is borne by the user. Log4j2 Vulnerability...

log4shell-mitigation

Details and Mitigation Strategy for log4j2 RCE Vulnerability Visit this Youtube video for additional details. https://youtu.be/jqWdwTeGRK0 This is a quick post on the mitigation for CVE-2021-44228 Security Vulnerability aka Log4Shell and LogJam found in log4j2 Disclaimer All the information and...

CVE-2019-17571

CVE-2019-17571 / Apache Log4j 1.2.X Deserialization Remote Code Execution Vulnerability Vulnerability warning reference link: https://mp.weixin.qq.com/s/okU2y0izfnKXXtXG3EfLkQ 1. Vulnerability Description Apache Log4j is a Java-based open-source logging tool developed by the Apache Software...

Log4Shell-CVE-2021-44228-Demo

CVE-2021–44228 Demo 1. Introducción a CVE-2021–44228 La noticia más grande en el mundo de la ciberseguridad a finales de 2021 fue la vulnerabilidad de Log4j, numerada como CVE-2021-44228, también conocida como Log4Shell. Fue clasificada con la puntuación máxima de gravedad de 10 en el sistema de...

CVE-2021-44228

CVE-2021-44228 Apache Log4j is a logging tool written in Java. This paper focuses on what is Log4j and log4shell vulnerability and how it works, how it affects the victim, and how can this be mitigated. Download the PDF and enjoy !!! Cheers !!!...

CVE-2021-44228

🛡️ CVE-2021-44228: Análisis de Log4Shell - La Vulnerabilidad que Revolucionó la Seguridad Java Impacto Crítico CVSS 10.0 | Descubierta en 2021, esta falla en Apache Log4j permite ejecución remota de código RCE y afecta a millones de sistemas globales. ¡Aún hoy, es un recordatorio clave para la...

log4j_checker_beta

log4jcheckerbeta - Linux, macOS and Windows Scripts If you want to use the windows/linux download cradles below, please review the scripts beforehand. Loading code from the internet and execute it is what brought us here with Log4Shell - right? ;- Linux and macOS servers or clients The...

Astra Linux – Vulnerability in libpgjava

In pgjdbc before version 42.3.3, an attacker who controls the jdbc URL or properties can use java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example scenario is that an attacker could create a executable JSP file under a...

CLSA-2026-1787726168 TuxCare security update for org.apache.logging.log4j (4 CVEs)

TuxCare rebuilt 30 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2...

Unity Linux 20.1070e Security Update: springframework (UTSA-2026-016702)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016702 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

EUVD-2002-0968

Malware in sbrugna...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

PoC exploit for CVE-2021-44228, a Java logging library vulnerability. The target product/service is Apache Log4j, a Java logging library. The vulnerability class/vector is RCE Remote Code Execution via JNDI Java Naming and Directory Interface lookup. The probable entry points are JNDI lookups...

Apache Log4j 安全漏洞

Apache Log4j is a Java-based open source logging tool from the Apache USA Foundation. A security vulnerability exists in Apache Log4j version 1.2 that stems from untrusted data deserialization...

Amazon Linux 2022 : log4j, log4j-jcl, log4j-slf4j (ALAS2022-2021-003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2021-003 advisory. A flaw was found in the Java logging library Apache Log4j 2 in versions from 2.0-beta9 and before and including 2.14.1. This could allow a remote attacker to execute code on the server if the system log...

Apache Log4j: Multiple Vulnerabilities

Background Log4j is a Java logging framework that supports various use cases with a rich set of components, a separate API, and a performance-optimized implementation. Description Multiple vulnerabilities hav been discovered in Apache Log4j. Please review the CVE identifiers referenced below for...

Important: log4j

Issue Overview: A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if JMSSink is deployed and has been configured to perform JNDI requests...

SUSE CVE-2023-26464

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...