Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: Qos Component: Logback Clear all filters
TI-2023-05939 CVE-2023-6481 · GHSA-gm62-rw4g-vrc4

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

Priority LOW 34

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00682 Published 2023-12-04 Partial fix · 1.4.14, 1.3.14 +1
TI-2023-05854 CVE-2023-6378 · GHSA-vmq6-5m68-f53m

Logback "receiver" DOS vulnerability

Priority LOW 35

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.009 Published 2023-11-29 Partial fix · 1.4.12, 1.3.12 +1 CWE-502
TI-2021-18835 CVE-2021-42550 · GHSA-668q-qrv7-99fm

RCE from attacker with configuration edit priviledges through JNDI lookup

Priority LOW 37

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0477 Published 2021-12-16 Partial fix · 1.2.9, 1.3.0-alpha11 CWE-502