95 matches found
log4j: Socket receiver deserialization vulnerability
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...
log4j: deserialization of untrusted data in SocketServer
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget...
log4j: Socket receiver deserialization vulnerability
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...
log4j: deserialization of untrusted data in SocketServer
A flaw was discovered in Log4j, where a vulnerable SocketServer class may lead to the deserialization of untrusted data. This flaw allows an attacker to remotely execute arbitrary code when combined with a deserialization gadget...
logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to...
logback: Serialization vulnerability in SocketServer and ServerSocketReceiver
It was found that logback is vulnerable to a deserialization issue. Logback can be configured to allow remote logging through SocketServer/ServerSocketReceiver interfaces that can accept untrusted serialized data. Authenticated attackers on the adjacent network can leverage this vulnerability to...
Apache logging component Log4j deserialization vulnerability affects all 2. x version-bug warning-the black bar safety net
! Open source stuff with more people, natural vulnerability. Apache for logging component Log4j to use the very flexible, in quite a lot of open source projects are using this exploit affects all Apache Log4j 2. Series version: Apache Log4j 2.0-alpha1 – Apache Log4j 2.8.1 using Java 7+users shoul...
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...
CVE-2017-5645
CVE-2017-5645 affects Apache Log4j 2.x prior to 2.8.2. The vulnerability arises when using a TCP/UDP socket server to receive serialized log events from another application; a crafted binary payload can be deserialized to execute arbitrary code. The documented impact is remote code execution via ...
CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...
CVE-2017-5645: Deserialization of Untrusted Data
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...
PT-2017-4052
Name of the Vulnerable Software and Affected Versions Apache Log4j versions prior to 2.8.2 Description The issue is related to the deserialization of log events in Apache Log4j. When using the TCP socket server or UDP socket server to receive serialized log events from another application, a...
QOS.ch Logback SocketServer and ServerSocketReceiver Component Elevation of Privilege Vulnerability
QOS.ch Logback is a set of logging framework written in Java . SocketServer and ServerSocketReceiver are among the debugging modules. A security vulnerability exists in the SocketServer and ServerSocketReceiver components of QOS.ch Logback versions prior to 1.1.10. An attacker can exploit this...
