Read the docs

QOS.CH Sarl

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

QOS.CH Sarl records in CISA KEV

No QOS.CH Sarl vulnerabilities are listed in CISA KEV.

Records

9 records

TI-2026-11065 CVE-2026-13006 · GHSA-567r-vvh5-jjr8

Incomplete protection against CVE-2025-11226

Priority LOW 32

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protectio…

CVSS 4.0HIGH 7.0 Local High privileges No interaction EPSS 0.00175 Published 2026-06-24 Partial fix · 1.5.37 CWE-20
TI-2025-10282 CVE-2025-11226 · GHSA-25qh-j22f-pwp8

Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino

Priority LOW 32

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logb…

CVSS 4.0HIGH 7.0 Local High privileges No interaction EPSS 0.00194 Published 2025-10-01 Partial fix · 1.5.19, 1.3.16 CWE-20
TI-2024-11860 CVE-2024-12798 · GHSA-pr98-23f8-jwxv

JaninoEventEvaluator vulnerability

Priority LOW 29

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback…

CVSS 4.0MEDIUM 5.9 Local Low privileges User interaction EPSS 0.00458 Published 2024-12-19 Partial fix · 1.3.15, 1.5.13 CWE-917
TI-2026-66127 CVE-2026-104721 · GHSA-5f86-rhcp-cxm6

Logback: Incomplete protection against CVE-2026-19880

Priority LOW 28

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2026-10-02 Partial fix · 1.6.5 CWE-22
TI-2026-16116 CVE-2026-19880 · GHSA-9mh8-hq67-v26g

Incomplete protection against CVE-2025-11226

Priority LOW 28

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00332 Published 2026-08-14 Partial fix · 1.6.3 CWE-22
TI-2026-09059 CVE-2026-10532 · GHSA-jhq6-gfmj-v8fx

Logback deserialization whitelist bypass for Proxy objects

Priority LOW 15

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0037 Published 2026-06-01 Fixed in 1.5.34 CWE-502
TI-2026-08607 CVE-2026-9828 · GHSA-p47f-322f-whfh

Logback deserialization whitelist bypass for java.lang and java.util

Priority LOW 15

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.0037 Published 2026-05-28 Fixed in 1.5.33 CWE-502
TI-2024-11863 CVE-2024-12801 · GHSA-6v67-2wr5-gvf4

SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks

Priority LOW 12

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in…

CVSS 4.0LOW 2.4 Local Low privileges User interaction EPSS 0.00226 Published 2024-12-19 Partial fix · 1.3.15, 1.5.13 CWE-918
TI-2026-00946 CVE-2026-1225 · GHSA-qqpg-mvqg-649v

Malicious logback.xml configuration file allows instantiation of arbitrary classes

Priority LOW 9

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromisi…

CVSS 4.0LOW 1.8 Local High privileges No interaction EPSS 0.00162 Published 2026-01-22 Partial fix · 1.5.25 CWE-20
Open these records in search →