Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-3pxv-7cmr-fjr4
  • Maven/org.apache.logging.log4j:log4j-core
 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters 10 Apr
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-445c-vh5m-36rj
  • Maven/org.apache.logging.log4j:log4j-core
 Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility 10 Apr
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-6hg6-v5c8-fphq
  • Maven/org.apache.logging.log4j:log4j-core
 Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration 10 Apr
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-vc5p-v9hr-52mj
  • Maven/org.apache.logging.log4j:log4j-core
 Apache Log4j does not verify the TLS hostname in its Socket Appender 18 Dec 2025
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-vp98-w2p3-mv35
  • Maven/log4j:log4j
  • Maven/org.apache.logging.log4j:log4j-core
 Apache Log4j 1.x (EOL) allows Denial of Service (DoS) 10 Mar 2023
  • Fix available
  • Severity - 7.5 (High)
GHSA-8489-44mv-ggj8
  • Maven/org.apache.logging.log4j:log4j-core
  • Maven/org.ops4j.pax.logging:pax-logging-log4j2
 Improper Input Validation and Injection in Apache Log4j2 04 Jan 2022
  • Fix available
  • Severity - 6.6 (Medium)
GHSA-p6xc-xr62-6r2g
  • Maven/org.apache.logging.log4j:log4j-core
  • Maven/org.ops4j.pax.logging:pax-logging-log4j2
 Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion 18 Dec 2021
  • Fix available
  • Severity - 8.6 (High)
GHSA-7rjr-3q55-vv33
  • Maven/org.apache.logging.log4j:log4j-core
  • Maven/org.ops4j.pax.logging:pax-logging-log4j2
 Incomplete fix for Apache Log4j vulnerability 14 Dec 2021
  • Fix available
  • Severity - 9.0 (Critical)
GHSA-jfh8-c2jp-5v3q
  • Maven/com.guicedee.services:log4j-core
  • Maven/org.apache.logging.log4j:log4j-core
  • Maven/org.ops4j.pax.logging:pax-logging-log4j2
  • Maven/org.xbib.elasticsearch:log4j
  • Maven/uk.co.nichesolutions.logging.log4j:log4j-core
 Remote code injection in Log4j 10 Dec 2021
  • Fix available
  • Severity - 10.0 (Critical)
GHSA-vwqq-5vrc-xw9h
  • Maven/org.apache.logging.log4j:log4j
  • Maven/org.apache.logging.log4j:log4j-core
 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender 05 Jun 2020
  • Fix available
  • Severity - 3.7 (Low)
GHSA-fxph-q3j8-mv87
  • Maven/org.apache.logging.log4j:log4j
  • Maven/org.apache.logging.log4j:log4j-core
 Deserialization of Untrusted Data in Log4j 06 Jan 2020
  • Fix available
  • Severity - 9.8 (Critical)