Количество 111
Количество 111
BDU:2023-07205
Уязвимость адаптера JDBCAppender программы для журналирования Java-программ Log4j, позволяющая нарушителю выполнять произвольные SQL-запросы к базе данных
BDU:2021-05940
Уязвимость Java-библиотеки Xstream для преобразования объектов в форматы XML или JSON, связанная с неограниченной загрузкой файлов опасного типа, позволяющая нарушителю загружать и выполнять произвольный код с удаленного хоста
BDU:2021-05946
Уязвимость Java-библиотеки Xstream для преобразования объектов в форматы XML или JSON, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнять команды на хосте
openSUSE-SU-2021:4112-1
Security update for log4j12
openSUSE-SU-2021:4111-1
Security update for log4j
openSUSE-SU-2021:1631-1
Security update for kafka
openSUSE-SU-2021:1612-1
Security update for log4j12
SUSE-SU-2021:4115-1
Security update for log4j
SUSE-SU-2021:4112-1
Security update for log4j12
SUSE-SU-2021:4111-1
Security update for log4j
SUSE-SU-2021:14866-1
Security update for log4j
GHSA-fp5r-v3w9-4333
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted ...
GHSA-vwqq-5vrc-xw9h
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
CVE-2020-9488
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2023-07205 Уязвимость адаптера JDBCAppender программы для журналирования Java-программ Log4j, позволяющая нарушителю выполнять произвольные SQL-запросы к базе данных | CVSS3: 9.8 | 11% Средний | около 4 лет назад |
| BDU:2021-05940 Уязвимость Java-библиотеки Xstream для преобразования объектов в форматы XML или JSON, связанная с неограниченной загрузкой файлов опасного типа, позволяющая нарушителю загружать и выполнять произвольный код с удаленного хоста | CVSS3: 9.1 | 90% Критический | почти 5 лет назад |
| BDU:2021-05946 Уязвимость Java-библиотеки Xstream для преобразования объектов в форматы XML или JSON, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнять команды на хосте | CVSS3: 9.9 | 87% Высокий | почти 5 лет назад |
 | openSUSE-SU-2021:4112-1 Security update for log4j12 | 74% Высокий | около 4 лет назад | |
| openSUSE-SU-2021:4111-1 Security update for log4j | 74% Высокий | около 4 лет назад | |
| openSUSE-SU-2021:1631-1 Security update for kafka | 74% Высокий | около 4 лет назад | |
| openSUSE-SU-2021:1612-1 Security update for log4j12 | 74% Высокий | около 4 лет назад | |
| SUSE-SU-2021:4115-1 Security update for log4j | 74% Высокий | около 4 лет назад | |
| SUSE-SU-2021:4112-1 Security update for log4j12 | 74% Высокий | около 4 лет назад | |
| SUSE-SU-2021:4111-1 Security update for log4j | 74% Высокий | около 4 лет назад | |
| SUSE-SU-2021:14866-1 Security update for log4j | 74% Высокий | около 4 лет назад | |
| GHSA-fp5r-v3w9-4333 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data | CVSS3: 7.5 | 74% Высокий | около 4 лет назад |
 | CVE-2021-4104 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. | CVSS3: 7.5 | 74% Высокий | около 4 лет назад |
 | CVE-2021-4104 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. | CVSS3: 7.5 | 74% Высокий | около 4 лет назад |
 | CVE-2021-4104 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. | CVSS3: 7.5 | 74% Высокий | около 4 лет назад |
| CVE-2021-4104 JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted ... | CVSS3: 7.5 | 74% Высокий | около 4 лет назад |
| GHSA-vwqq-5vrc-xw9h Improper validation of certificate with host mismatch in Apache Log4j SMTP appender | CVSS3: 3.7 | 0% Низкий | больше 5 лет назад |
| CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 | CVSS3: 3.7 | 0% Низкий | почти 6 лет назад |
| CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 | CVSS3: 3.7 | 0% Низкий | почти 6 лет назад |
| CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 | CVSS3: 3.7 | 0% Низкий | почти 6 лет назад |
Уязвимостей на страницу