Search for packages
| purl | pkg:maven/log4j/log4j@1.2.14 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-fp5r-v3w9-4333
Aliases: CVE-2021-4104 |
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j … | There are no reported fixed by versions. |
|
GHSA-65fg-84f6-3jq3
Aliases: CVE-2022-23305 |
SQL Injection in Log4j 1.2.x By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter … | There are no reported fixed by versions. |
|
GHSA-w9p3-5cr8-m3jj
Aliases: CVE-2022-23302 |
Deserialization of Untrusted Data in Log4j 1.x JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted … | There are no reported fixed by versions. |
|
GHSA-f7vh-qwp3-x37m
Aliases: CVE-2022-23307 |
Deserialization of Untrusted Data in Apache Log4j CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to … | There are no reported fixed by versions. |
|
GHSA-vp98-w2p3-mv35
Aliases: CVE-2023-26464 |
Apache Log4j 1.x (EOL) allows Denial of Service (DoS) ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender … | There are no reported fixed by versions. |
|
GHSA-2qrg-x229-3v8q
Aliases: CVE-2019-17571 |
Deserialization of Untrusted Data in Log4j Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of … | There are no reported fixed by versions. |
|
CVE-2022-23307
|
Deserialization of Untrusted Data CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw … | There are no reported fixed by versions. |
|
CVE-2020-9488
|
Improper Certificate Validation Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS … | There are no reported fixed by versions. |
|
CVE-2021-4104
|
Deserialization of Untrusted Data JMSAppender in Log4j is vulnerable to deserialization of untrusted data when the attacker has write access … | There are no reported fixed by versions. |
|
CVE-2019-17571
Aliases: GHSA-2qrg-x229-3v8q |
Deserialization of Untrusted Data in Log4j Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of … | There are no reported fixed by versions. |