395 matches found
CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...
CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...
Vulnerability fixed in Apache Log4j2
A serious vulnerability has been fixed in Apache Log4j, a java log tool used by many Web applications and services. The vulnerability makes it possible for an unauthenticated remote malicious person to execute arbitrary code with the permissions of the Web server. Because Web servers generally ru...
CVE-2021-44228
Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...
CVE-2021-44228
Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...
CVE-2021-44228: Deserialization of Untrusted Data
Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...
com.esri.geoevent.sdk:geoevent-sdk (>=10.6.0, <=10.7.0), com.savoirtech.aetos:aetos (4.1.1.0) +80 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.8.2, <=1.9.1)
org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.8.2, =10.6.0, =0.2.0, =7.3.0, =7.3.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.3.0 - de.mhus.app:mhus-web 7.2.0 - de.mhus.app:web-api 7.2.0 - de.mhus.app:web-core 7.2.0 - de.mhus.app:web-jetty 7.2.0 - de.mhus.app:web-util 7.2.0 and more...
com.esri.geoevent.sdk:geoevent-sdk (10.9.1), hu.blackbelt.osgi.filestore:features (>=1.2.1, <=1.3.0) +50 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=2.0.0, <=2.0.10)
org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =2.0.0, =1.2.1, =1.2.1, =1.0.12, =1.0.12, =2.14.2, =1.2.5, =2.18.0, =3.11.1, =3.10.0, =4.3.0.rc1, =4.3.0.rc1, =4.3.3 - org.apache.karaf.features:enterprise-legacy 4.3.0.rc1 and more Source cves: CVE-2021-44228 Source advisory:...
com.esri.geoevent.sdk:geoevent-sdk (10.9.0), com.influxdb:influxdb-karaf (>=2.2.0, <=5.0.0) +101 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.11.3, <=1.11.9)
org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.11.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =5.0.0 - de.mhus.app.reactive:reactive-dev 7.9.0 - de.mhus.app.reactive:reactive-karaf 7.9.0 - de.mhus.app.vault:vault-api 7.7.0 - de.mhus.app.vault:vault-core 7.7.0 - de.mhus.app.vault:vault-manager...
ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0), com.esri.geoevent.sdk:geoevent-sdk (>=10.7.1, <=10.8.1) +118 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.10.0, <=1.10.7)
org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.10.0, =3.3.0, =10.7.1, =2.0.1, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.611, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.24.01 and more Source cves: CVE-2021-44228 Source advisory: MEND:CVE-2021-44228...
Security Notice – Statement About Apache Log4j2 Vulnerabilities
Huawei has noticed that since December 9, the Apache official website has disclosed the Apache Log4j2 remote code execution vulnerability CVE-2021-44228, followed by the CVE-2021-45046 and CVE-2021-45105 vulnerabilities. These vulnerabilities can be remotely exploited. To prevent these...
Log4Shell HTTP Header Injection
Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by...
Log4Shell HTTP Scanner
Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will scan an HTTP end point for the Log4Shell vulnerability by injectin...
VulnCheck KEV: CVE-2021-45046
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations...