395 matches found
CVE-2023-50780 Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could...
CVE-2023-50780
Apache ActiveMQ Artemis suffers a vulnerability where diagnostic MBeans (including the Log4J2 MBean) are exposed through the Jolokia endpoint, accessible to authenticated users. Before version 2.29.0 this exposure could allow an authenticated attacker to write arbitrary files to the filesystem an...
CVE-2023-50780: Improper Authorization
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could...
log4j2:log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer: Security exception in org.apache.logging.log4j.layout.template.json.util.JsonReader.readObjectKey
Detailed Report: https://oss-fuzz.com/testcase?key=4666448637657088 Project: log4j2 Fuzzing Engine: libFuzzer Fuzz Target: log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer Job Type: libfuzzerasanlog4j2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
log4j2:log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer: Security exception in org.apache.logging.log4j.layout.template.json.util.JsonReader.readToken
Detailed Report: https://oss-fuzz.com/testcase?key=5866173562945536 Project: log4j2 Fuzzing Engine: libFuzzer Fuzz Target: log4j-layout-template-json-fuzz-test-JsonTemplateLayoutCodecFuzzer Job Type: libfuzzerasanlog4j2 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
Log4Shell HTTP Scanner
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Log4Shell HTTP Scanner', 'Description' = %q Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration,...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
CVE-2021-44228 Analysis How does it work? Below is a deta...
PT-2023-9583
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.29.0 Description The issue is related to the exposure of diagnostic information and controls through MBeans, which are also accessible through the authenticated Jolokia endpoint. This includes the...
Ubuntu 18.04 LTS / 20.04 LTS : Apache Log4j 2 vulnerabilities (USN-5222-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5222-1 advisory. It was discovered that Apache Log4j 2 was vulnerable to remote code execution RCE attack when configured to use a JDBC Appender with a JNDI...
Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected
The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three flaws to the Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The security vulnerabilities are as follows - CVE-2023-1389 CVSS score: 8.8 - TP-Link Archer AX-21 Command Injection...
Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected
The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three flaws to the Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The security vulnerabilities are as follows - CVE-2023-1389 CVSS score: 8.8 - TP-Link Archer AX-21 Command Injection...
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
Proof of Concept for Log4j CVE-2021-44228 Disclaimer Th...
K34162192: Apache log4j2 denial-of-service vulnerability CVE-2021-45105
Security Advisory Description Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string...
K32171392: Apache Log4j2 vulnerability CVE-2021-45046
Security Advisory Description It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern...
K14122652: Apache Log4j2 vulnerability CVE-2021-44832
Security Advisory Description Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration...
K19026212: Apache Log4j2 Remote Code Execution vulnerability CVE-2021-44228
Security Advisory Description Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can contro...
FreeBSD : Rundeck3 -- Log4J RCE vulnerability (27c822a0-addc-11ed-a9ee-dca632b19f10)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 27c822a0-addc-11ed-a9ee-dca632b19f10 advisory. - Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are...
VulnCheck KEV: CVE-2021-44832
Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is...