CVE-2021-4095

A NULL pointer dereference was found in the Linux kernel's KVM when dirty ring logging is enabled without an active vCPU context. An unprivileged local attacker on the host may use this flaw to cause a kernel oops condition and thus a denial of service by issuing a KVMXENHVMSETATTR ioctl...

Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021

Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against...

hu.blackbelt.osgi.filestore:features (>=1.2.1 <=1.3.0), hu.blackbelt.osgi.filestore:kar (>=1.2.1 <=1.3.0) +40 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=2.0.0 <=2.0.10)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =2.0.0, =1.2.1, =1.2.1, =1.0.12, =1.0.12, =2.14.2, =2.19.0, =3.12.0, =3.12.0, =3.14.0 - org.apache.cxf.karaf:apache-cxf =3.5.0 - org.apache.karaf.examples:karaf-docker-example-dynamic-dist =4.3.3 - org.apache.karaf.features:enterprise =4.3.3 ...

ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0 <=3.7.0), com.esri.geoevent.sdk:geoevent-sdk (>=10.7.1 <=10.8.1) +118 more potentially affected by CVE-2021-44228 via org.ops4j.pax.logging:pax-logging-log4j2 (>=1.10.0 <=1.10.7)

org.ops4j.pax.logging:pax-logging-log4j2 MAVEN version =1.10.0, =3.3.0, =10.7.1, =2.0.1, =1.2.0, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.61.2, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =3.24.01 and more Source cves: CVE-2021-44228 Source advisory: OSV:GHSA-JFH8-C2JP-5V3Q...

CVE-2021-44228

CVE-2021-44228 (Log4Shell) affects Apache Log4j2 2.0-beta9 through 2.15.0 (excluding some security releases) and is specific to log4j-core. The vulnerability arises from JNDI features used in configuration, log messages, and parameters, which can be exploited when an attacker can control log mess...

Apache Log4j2 Remote Code Execution Vulnerability

Apache Log4j2 is a Java logging framework. Apache Log4j2 remote code execution vulnerability, due to the existence of recursive parsing of certain Apache Log4j2 features, an attacker can use the vulnerability to directly construct malicious requests and trigger remote code execution...

Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation

The Apache Software Foundation has released a security advisory to address a remote code execution vulnerability CVE-2021-44228 affecting Log4j versions 2.0-beta9 to 2.14.1. A remote attacker could exploit this vulnerability to take control of an affected system. Log4j is an open-source, Java-bas...

Apache Log4j JAR Detection (Windows)

Binary data apachelog4jwininstalled.nbin...

UBUNTU-CVE-2021-44228

Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message...

Has your WordPress site been backdoored by a skimmer?

Skimmers and other threat actors are backdooring websites, and WordPress instances in particular, according to a recently released report. Researchers at Sucuri say attackers have developed methods to make sure that their grip on the infected site is not easily removed by applying the next update...

Mattermost 日志信息泄露漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost is vulnerable to a logging information disclosure vulnerability that stems from the software's failure to adequately clean up the user's password in the audit log when the user fails to create, which could be...

Squaredup安全漏洞

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. a file inclusion vulnerability in the download logging functionality in SquaredUp for SCOM version 5.2.1.6654 System/Maintenance could be exploited to read arbitrary files on the server...

Google Android 日志日志信息泄露漏洞

Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to a logging information disclosure vulnerability, which can be exploited by attackers to cause local information disclosure without additional execution privileges...

OPENSUSE-SU-2021:1524-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.6.8: Improving reporting of general overload state for DNS timeout errors by relays Regenerate fallback directories for October 2021 Bug fixes for onion services CVE-2021-22929: do not log v2 onion services access attempt warnings on disk...

SUSE-SU-2021:3906-1 Security Beta update for Salt

This update fixes the following issues: salt: - Remove wrong parsecpename from grains.core - Prevent tracebacks if directory for cookie is missing - Fix file.find tracebacks with non utf8 file names bsc1190114 - Fix ip6interface grain to not leak secondary IPv4 aliases bsc1191412 - Do not conside...

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

...

Malicious Google Play Apps Stole User Banking Info

Using tricks to sidestep the app store's restrictions, malware operators pillaged passwords, keystrokes, and other data...

Information disclosure

Sensitive information could be logged. The following products are affected: Acronis Agent Windows, Linux, macOS before build 27147...

CVE-2021-34800

CVE-2021-34800 affects Acronis Agent (Windows, Linux, macOS) prior to build 27147. The vulnerability is an information disclosure where sensitive product details are logged in log files. Connected sources confirm affected builds and describe the issue as a log information disclosure; no exploitat...

OPENSUSE-SU-2021:1513-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.6.8: Improving reporting of general overload state for DNS timeout errors by relays Regenerate fallback directories for October 2021 Bug fixes for onion services CVE-2021-22929: do not log v2 onion services access attempt warnings on disk...