CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

2465 matches found

OpenVAS•added 2025/12/19 12:0 a.m.•10 views

Apache Log4j 2.x < 2.25.3 Missing TLS Hostname Verification Vulnerability - Linux

Apache Log4j is prone to a missing TLS hostname verification vulnerability in the socket appender. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

6.3CVSS6.5AI score0.00756EPSS

Exploits1References2

OpenVAS•added 2025/12/19 12:0 a.m.•4 views

Apache Log4j 2.x < 2.25.3 Missing TLS Hostname Verification Vulnerability - Windows

6.3CVSS6.5AI score0.00756EPSS

Exploits1References2

vulnersOsv•added 2025/12/18 9:45 p.m.•7 views

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1 <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0 <=0.1.1) +21555 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0 <=2.25.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.0, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.8 and more Source cves: CVE-2025-68161 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-14532782...

6.3CVSS6.2AI score0.00756EPSS

Exploits1

Snyk•added 2025/12/18 9:45 p.m.•3 views

Improper Validation of Certificate with Host Mismatch

Overview org.apache.logging.log4j:log4j-core is a logging library for Java. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the lack of TLS hostname verification in the SocketAppender component. An attacker can intercept or redirect...

6.3CVSS6.7AI score0.00756EPSS

Exploits1References2

vulnersOsv•added 2025/12/18 9:31 p.m.•9 views

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1 <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0 <=0.1.1) +21456 more potentially affected by CVE-2025-68161 via org.apache.logging.log4j:log4j-core (>=2.0-beta9 <=2.25.2)

org.apache.logging.log4j:log4j-core MAVEN version =2.0-beta9, =0.14.1, =0.1.0, =0.9.6, =0.12.0, =0.9.6, =0.9.6, =0.9.6, =0.9.6, =0.14.1, =0.9.6, =0.14.1, =4.4.0.0, =1.4.6, =1.4.6, =1.4.8 and more Source cves: CVE-2025-68161 Source advisory: OSV:GHSA-VC5P-V9HR-52MJ...

6.3CVSS6.2AI score0.00756EPSS

Exploits1

Github Security Blog•added 2025/12/18 9:31 p.m.•13 views

Apache Log4j does not verify the TLS hostname in its Socket Appender

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system property is set to true. This issue may allow a...

6.3CVSS6.8AI score0.00756EPSS

Exploits1References10Affected Software1

OSV•added 2025/12/18 9:31 p.m.•8 views

GHSA-VC5P-V9HR-52MJ Apache Log4j does not verify the TLS hostname in its Socket Appender

6.3CVSS5.8AI score0.00756EPSS

Exploits1References10

NVD•added 2025/12/18 9:15 p.m.•8 views

CVE-2025-68161

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.htmlSslConfiguration-attr-verifyHostName configuration attribut...

6.3CVSS0.00756EPSS

Exploits1References8

OSV•added 2025/12/18 9:15 p.m.•5 views

DEBIAN-CVE-2025-68161

4.8CVSS6.1AI score0.00756EPSS

Exploits1References1

UbuntuCve•added 2025/12/18 9:15 p.m.•6 views

CVE-2025-68161

6.3CVSS6.7AI score0.00756EPSS

Exploits1References8

OSV•added 2025/12/18 9:15 p.m.•7 views

UBUNTU-CVE-2025-68161

6.3CVSS6.4AI score0.00756EPSS

Exploits1References9

Vulnrichment•added 2025/12/18 8:47 p.m.•5 views

CVE-2025-68161 Apache Log4j Core: Missing TLS hostname verification in Socket appender

6.3CVSS6.4AI score0.00756EPSS

Exploits1References6

OSV•added 2025/12/18 8:47 p.m.•7 views

CVE-2025-68161 Apache Log4j Core: Missing TLS hostname verification in Socket appender

6.3CVSS6.4AI score0.00756EPSS

Exploits1References11

Cvelist•added 2025/12/18 8:47 p.m.•28 views

CVE-2025-68161 Apache Log4j Core: Missing TLS hostname verification in Socket appender

6.3CVSS0.00756EPSS

Exploits1References6

CVE•added 2025/12/18 8:47 p.m.•349 views

CVE-2025-68161

CVE-2025-68161 affects Apache Log4j Core Socket Appender (versions 2.0-beta9–2.25.2). Root cause: TLS hostname verification is not performed for peer certificates when configured via verifyHostName or the log4j2.sslVerifyHostName setting. Impact: potential MITM interception/redirection of log tra...

6.3CVSS6.4AI score0.00756EPSS

Exploits1References8Affected Software1

Debian CVE•added 2025/12/18 8:47 p.m.•8 views

CVE-2025-68161

6.3CVSS6.1AI score0.00756EPSS

Exploits1

Positive Technologies•added 2025/12/18 12:0 a.m.•5 views

PT-2025-52349

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions 2.0-beta9 through 2.25.2 Description The Socket Appender in Apache Log4j Core does not verify the hostname of the peer certificate during TLS connections, even when configured to do so. This could allow a...

6.3CVSS6.4AI score0.00756EPSS

Exploits1References294

CNNVD•added 2025/12/18 12:0 a.m.•6 views

Apache Log4j 安全漏洞

Apache Log4j is a Java-based open source logging tool from the Apache USA Foundation. A security vulnerability exists in Apache Log4j 2.25.2 and earlier versions, which stems from an unperformed TLS hostname validation and could lead to a man-in-the-middle attack...

6.3CVSS6.2AI score0.00756EPSS

Exploits1References10