Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4jHotPatch This is a tool which injects a Java agent into...

Extremely Critical Log4J Vulnerability Leaves Much of the Internet at Risk

The Apache Software Foundation has released fixes to contain an actively exploited zero-day vulnerability affecting the widely-used Apache Log4j Java-based logging library that could be weaponized to execute malicious code and allow a complete takeover of vulnerable systems. Tracked as...

Remote code injection in Log4j (through pax-logging-log4j2)

Impact Remote Code Execution. Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11. Workarounds Set system property -Dlog4j2.formatMsgNoLookups=true References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q...

GHSA-XXFH-X98P-J8FR Remote code injection in Log4j (through pax-logging-log4j2)

Impact Remote Code Execution. Patches Users of pax-logging 1.11.9 should update to 1.11.10. Users of pax-logging 2.0.10 should update to 2.0.11. Workarounds Set system property -Dlog4j2.formatMsgNoLookups=true References https://github.com/advisories/GHSA-jfh8-c2jp-5v3q...

A Log4J Vulnerability Has Set the Internet 'On Fire'

The flaw in the logging framework has security teams scrambling to put in a fix...

CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl...

Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021

Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against...

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 is a Java logging framework. Apache Log4j2 remote code execution vulnerability, due to the existence of recursive parsing of certain Apache Log4j2 features, an attacker can use the vulnerability to directly construct malicious requests and trigger remote code execution...

Apache Log4j JAR Detection (Windows)

Binary data apachelog4jwininstalled.nbin...

PT-2021-24476

Name of the Vulnerable Software and Affected Versions: pax-logging versions 1.11.9 pax-logging versions 2.0.10 Description: The issue allows for Remote Code Execution. Users can set the system property -Dlog4j2.formatMsgNoLookups=true as a workaround. Recommendations: For pax-logging version...

CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

UBUNTU-CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...

Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation

The Apache Software Foundation has released a security advisory to address a remote code execution vulnerability CVE-2021-44228 affecting Log4j versions 2.0-beta9 to 2.14.1. A remote attacker could exploit this vulnerability to take control of an affected system. Log4j is an open-source, Java-bas...

Has your WordPress site been backdoored by a skimmer?

Skimmers and other threat actors are backdooring websites, and WordPress instances in particular, according to a recently released report. Researchers at Sucuri say attackers have developed methods to make sure that their grip on the infected site is not easily removed by applying the next update...

CVE-2021-37861: Insertion of Sensitive Information into Log File

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails...

Mattermost 日志信息泄露漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a logging information disclosure vulnerability that stems from the software's failure to adequately clean up the user's password in the audit log when the user fails to create, which could be...

Squaredup安全漏洞

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. a file inclusion vulnerability in the download logging functionality in SquaredUp for SCOM version 5.2.1.6654 System/Maintenance could be exploited to read arbitrary files on the server...

Google Android 日志日志信息泄露漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to a logging information disclosure vulnerability, which can be exploited by attackers to cause local information disclosure without additional execution privileges...

OPENSUSE-SU-2021:1524-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.6.8: Improving reporting of general overload state for DNS timeout errors by relays Regenerate fallback directories for October 2021 Bug fixes for onion services CVE-2021-22929: do not log v2 onion services access attempt warnings on disk...

SUSE-SU-2021:3906-1 Security Beta update for Salt

This update fixes the following issues: salt: - Remove wrong parsecpename from grains.core - Prevent tracebacks if directory for cookie is missing - Fix file.find tracebacks with non utf8 file names bsc1190114 - Fix ip6interface grain to not leak secondary IPv4 aliases bsc1191412 - Do not conside...