CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2022-23302

CVE-2022-23302 affects Log4j 1.x JMSSink. TheDeserialization flaw allows remote code execution when an attacker can write to the Log4j configuration or when the configuration references an LDAP service the attacker controls. JMSSink can be triggered via a TopicConnectionFactoryBindingName to caus...

CVE-2022-23307

CVE-2022-23307 concerns a deserialization vulnerability in the Chainsaw component of Apache Log4j 1.x (Chainsaw bundled with Log4j 1.2.x). The root cause is unsafe deserialization of untrusted data via Chainsaw, allowing potential code execution. Multiple Atlassian products initially bundled Chai...

CVE-2022-23305

CVE-2022-23305 concerns Apache Log4j 1.x when configured with JDBCAppender: an SQL statement is built from a PatternLayout-converted value (notably %m), allowing an attacker to craft input to alter and potentially execute SQL. The issue is specific to Log4j 1.x if JDBCAppender is used; JDBCAppend...

CVE-2021-2253

CVE-2021-2253 affects Oracle Advanced Supply Chain Planning (Oracle Supply Chain) Core in versions 12.1 and 12.2. The vulnerability arises in the core component, enabling an unauthenticated attacker to compromise via HTTP over network access, potentially leading to unauthorized creation, deletion...

CVE-2016-5599

CVE-2016-5599 affects Oracle Supply Chain Products Suite, specifically the Oracle Advanced Supply Chain Planning (ASCP) component versions 12.2.3–12.2.5. The vulnerability is described as an unspecified remote issue tied to the MscObieeSrvlt subcomponent that could compromise confidentiality and ...