VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago
Reset
More filters (1)
Columns
Oracle product: Oracle Communications Applications / Logging (Apache Log4j)✕
Overview 3 matches, all in RASP scope, all protected, all public PoC, all EPSS ≥ 0.5 · 0 KEV · 0 CISA SSVC · 0 disputed
3matches, all in RASP scope, all protected, all public PoC, all EPSS ≥ 0.5 0KEV0.0% 0CISA SSVC0.0% 0disputed0.0%
Critical 2 66.7% High 0 0.0% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 3 100.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 1 33.3% Proof of concept only 1 33.3% Forecast only 1 33.3% No public exploit 0 0.0%
split by peak 1 / quarter
Unknown: 0None: 0Low: 0Medium: 1High: 0Critical: 2 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 0Mitigation candidate: 0Rule in development: 0Protected by RASP: 3 unrecorded: 0not established: 0not blocked: 0blocked by ARMR today: 3 No public exploit: 0Forecast only: 1Proof of concept only: 1Working exploit published: 1Exploited in the wild: 0 Q2 2017: 1 CVE Q3 2017: 0 CVEs Q4 2017: 0 CVEs Q1 2018: 0 CVEs Q2 2018: 0 CVEs Q3 2018: 0 CVEs Q4 2018: 0 CVEs Q1 2019: 0 CVEs Q2 2019: 0 CVEs Q3 2019: 0 CVEs Q4 2019: 0 CVEs Q1 2020: 0 CVEs Q2 2020: 0 CVEs Q3 2020: 0 CVEs Q4 2020: 0 CVEs Q1 2021: 0 CVEs Q2 2021: 0 CVEs Q3 2021: 0 CVEs Q4 2021: 1 CVE Q1 2022: 1 CVE
Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22
3 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2022-23305 Critical 2022-01-18 Protected by RASP Proof of concept only By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-44832 Medium 2021-12-28 Protected by RASP Forecast only Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2017-5645 Critical 2017-04-17 Protected by RASP Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.