Read the docs

Qos

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Qos records in CISA KEV

No Qos vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Reload4j 5 records CRITICAL Logback 4 records MEDIUM Slf4j 1 record MEDIUM

Records

4 records in Logback · all components

TI-2021-18835 CVE-2021-42550 · GHSA-668q-qrv7-99fm

RCE from attacker with configuration edit priviledges through JNDI lookup

Priority LOW 37

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0477 Published 2021-12-16 Partial fix · 1.2.9, 1.3.0-alpha11 CWE-502
TI-2023-05854 CVE-2023-6378 · GHSA-vmq6-5m68-f53m

Logback "receiver" DOS vulnerability

Priority LOW 35

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.009 Published 2023-11-29 Partial fix · 1.4.12, 1.3.12 +1 CWE-502
TI-2023-05939 CVE-2023-6481 · GHSA-gm62-rw4g-vrc4

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

Priority LOW 34

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00682 Published 2023-12-04 Partial fix · 1.4.14, 1.3.14 +1
Open these records in search →