Operational information regarding the vulnerability in the Log4j logging library.

Related tags

Security related resourceslog4jcve-2021-44228log4shell
Overview

Log4j Vulnerability (CVE-2021-44228)

This repo contains operational information regarding the vulnerability in the Log4j logging library (CVE-2021-44228). For additional information see:

Repository contents

Directory Purpose
hunting Contains info regarding hunting for exploitation
iocs Contains any Indicators of Compromise, such as scanning IPs, etc
mitigation Contains info regarding mitigation, such as regexes for detecting scanning activity and more
scanning Contains references to methods and tooling used for scanning for the Log4j vulnerability
software Contains a list of known vulnerable and not vulnerable software
tools Contains a list of tools for automatically parsing info on this repo

Please note that these directories are not complete, and are currently being expanded.

NCSC-NL has published a HIGH/HIGH advisory for the Log4j vulnerability. Normally we would update the HIGH/HIGH advisory for vulnerable software packages, however due to the extensive amounts of expected updates we have created a list of known vulnerable software in the software directory.

Contributions welcome

If you have any additional information to share relevant to the Log4j vulnerability, please feel free to open a Pull request. New to this? Read how to contribute in GitHub's documentation.

Thank you

Dear contributors, partners all over the world,

We have received an impressive/enormous number of pull requests on this repo. It contains vital information that contributes to the situational overview around the Log4j vulnerability. The list of vulnerable applications is currently one of the most up-to-date ones with continuous input from across the globe. It is still expanding and we are working hard to process all the contributions.

Due to our joint efforts and strong cooperation we are confident that we will be better equipped to manage this situation.

Thank you all very much for your hard work and we keep welcoming your input via GitHub.

Comments
  • APC - PowerChute Business Edition

    APC - PowerChute Business Edition

    Not visible anything on their site yet:

    C:\Program Files (x86)\APC\PowerChute Business Edition\agent\lib>dir | findstr log4j

    10-12-2020 18:42 264,058 log4j-api-2.11.1.jar 10-12-2020 18:42 1,607,936 log4j-core-2.11.1.jar 10-12-2020 18:42 23,242 log4j-slf4j-impl-2.11.1.jar

    PowerChute Business Edition - 10.0.2.301

    investigate 
    opened by OS3DrNick 8
  • ESET Secure Authentication

    ESET Secure Authentication

    ESET states that they're not vulnerable, but we have various companies that Have ESET Secure Authentication installed and perform a scan for files, then we see that log4j is included in ESET Secure Authentication in the Elasticsearch component which they're shipping in their binary.

    [2021-12-16 10:19:27.784944] VULNERABLE: C:\Program Files\ESET Secure Authentication\elasticsearch\lib\log4j-core-2.11.1.jar -> org\apache\logging\log4j\core\net\JndiManager.class [04fdd701809d17465c17c7e603b1b202: log4j 2.9.0 - 2.11.2]

    [2021-12-16 10:19:28.847458] VULNERABLE: C:\Program Files\ESET Secure Authentication\elasticsearch\search-guard-tlstool-1.7\deps\log4j-core-2.11.1.jar -> org\apache\logging\log4j\core\net\JndiManager.class [04fdd701809d17465c17c7e603b1b202:log4j 2.9.0 - 2.11.2]

    software PR-requested 
    opened by nvaert1986 6
  • Add Waters product statement

    Add Waters product statement

    Add product statement for family of Waters informatics solutions

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x ] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x ] Status: please select a value from the status table at the top
    • [ x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x ] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x ] Please mind the sorting
    software Stale 
    opened by StefanTIB 5
  • Update voor Dell EMC Unity

    Update voor Dell EMC Unity

    Dell EMC heeft versie 5.1.2.0.5.007 voor de Dell EMC Unity uitgebracht. "This release addresses the Apache Log4j issue", maar aangezien er (nog) geen release notes beschikbaar zijn weet ik niet welke van de CVE's wel of niet verholpen zijn.

    opened by dennixxNL 5
  • Add Fedex Ship Manager

    Add Fedex Ship Manager

    Updated Fedex Ship Manager to 3509, adding notes about pending 3510 update 1/24.

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [ ] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [ ] Status: please select a value from the status table at the top
    • [ ] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [ ] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [ ] Please mind the sorting
    software Stale 
    opened by Gadgetgeek2000 5
  • FEDEX Ship Manager

    FEDEX Ship Manager

    Following files were found on the FEDEX Ship Manager server installation, version 3508:

    C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-api-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-core-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-jcl-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4j-slf4j-impl-2.8.2.jar C:\Program Files (x86)\FedEx\ShipManager\BIN\OfflineFastServicePublisher_lib\log4jna-api-2.0.jar

    software PR-requested 
    opened by Gadgetgeek2000 5
  • Add Beyond Compare and Bitwarden not vuln

    Add Beyond Compare and Bitwarden not vuln

    Neighter are vuln Beyondcompare makes the remark in the footer of there site.

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • Status: please select a value from the status table at the top
    • Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • Please mind the sorting
    • Please put vendor/product name in PR title (instead of "Update README.md")
    opened by abtomat-inf 5
  • Added note from Schneider Electric about APC software

    Added note from Schneider Electric about APC software

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • Status: please select a value from the status table at the top
    • Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • Please mind the sorting
    • Please put vendor/product name in PR title (instead of "Update README.md")
    opened by ipbgeek 5
  • Add Fujifilm to software list

    Add Fujifilm to software list

    from advisory sent by vendor

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x] Status: please select a value from the status table at the top
    • [x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x] Please mind the sorting
    software Stale 
    opened by alkajazz 4
  • Update software_list_s.md

    Update software_list_s.md

    Updated Stormshield with specific advisory for StormShield Visibility Center (only product announced vulnerable to CVE-2021-44228) Updated SonicWall product list based on v2.3 of their advisory

    Thank you for your contribution! Some pointers to get it merged quickly:

    For contributions in software/:

    • [x] PR Title: Please use "Add <vendor/product name>" (instead of "Update README.md")
    • [x] Status: please select a value from the status table at the top
    • [x] Version: Status Vulnerable / Workaround? -> List vulnerable versions. Status Fix? -> List fixed versions.
    • [x] Links: make sure you link to a public statement by the developer. Alternatively, include and link a file in the software/vendor-statements/ directory
    • [x] Please mind the sorting
    software 
    opened by anssi-cvp 4
  • please improve formatting quality

    please improve formatting quality

    The quality of markdown tables is slowly deteriorating:

    • some entries don't have a trailing |, some do
    • some table uses a different separator than |:----, namely |----

    This makes it hard for automated parsing tools to access the data.

    Doing a one-shot cleanup and sending a pull request fixing half the entries would not be wise, because it would make all the other waiting pull requests unmergeable. Also, implementing a commit hook would make the entire file un-commitable.

    My idea would be to

    • fix |:--- manually
    • ask contributors for a more rigid input formatting
    • add a pre-merge-commit hook, that would only check the diff for violations of the code, so that the old code can still be ugly (for some time)
    software PR-requested 
    opened by milankowww 4
Releases(log4shell_info_20220615)
Owner
Nationaal Cyber Security Centrum (NCSC-NL)
Nationaal Cyber Security Centrum (NCSC-NL)
GitHub Repository
Valeria stealer- - (4Feb 2022) program detects wifi saved passwords in your ROM

Valeria_stealer- Requirements : python 3.9.2 and higher (4Feb 2022) program dete

Mikhail Yolkin 3 May 05, 2022
Statistical Random Number Generator Attack Against The Kirchhoff-law-johnson-noise (Kljn) Secure Key Exchange Protocol

Statistical Random Number Generator Attack Against The Kirchhoff-law-johnson-noise (Kljn) Secure Key Exchange Protocol

zeze 1 Jan 13, 2022
This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

CVE-2021-40444 builders This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit. This repo is just for testing, re

ASL IT Security 168 Nov 09, 2022
MS-FSRVP coercion abuse PoC

ShadowCoerce MS-FSRVP coercion abuse PoC Credits: Gilles LIONEL (a.k.a. Topotam)

Shutdown 219 Dec 28, 2022
Fast Fb Cracking Tool

fb-brute Fast Fb Cracking Tool 🏆

Aryan 8 Jun 29, 2022
wsvuls - website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.]

WSVuls Website vulnerability scanner detect issues [ outdated server software and insecure HTTP headers.] What's WSVuls? WSVuls is a simple and powerf

Anouar Ben Saad 47 Sep 22, 2022
A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms. Change the Blackgound image of targets' computer. and decrypt the targets' encrypted files in our own compute

Li Ka Lok 2 Dec 02, 2022
Log4j command generator: Generate commands for CVE-2021-44228

Log4j command generator Generate commands for CVE-2021-44228. Description The vulnerability exists due to the Log4j processor's handling of log messag

1 Jan 03, 2022
A passive-recon tool that parses through found assets and interacts with the Hackerone API

Hackerone Passive Recon Tool A passive-recon tool that parses through found assets and interacts with the Hackerone API. Setup Simply run setup.sh to

elbee 4 Jan 13, 2022
the swiss army knife in the hash field. fast, reliable and easy to use

hexxus Hexxus is a fast hash cracking tool which checks more than 30 thousand passwords in under 4 seconds and can crack the following types bcrypt sh

enigma146 17 Apr 05, 2022
Herramienta para descargar eventos de Sucuri WAF hacia disco.

Descarga los eventos de Sucuri Script para descargar los eventos del Sucuri Web Application Firewall (WAF) en el disco como archivos CSV. Requerimient

CSIRT-RD 2 Nov 29, 2021
CVE-2022-22963 PoC

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for English translation and detection of https://github.com/chaosec2021/Spring-cloud-function-SpEL-R

Nicolas Krassas 104 Dec 08, 2022
Python implementation of the diceware password generating algorithm.

Diceware Password Generator - Generate High Entropy Passwords Please Note - This Program Do Not Store Passwords In Any Form And All The Passwords Are

Sameera Madushan 35 Dec 25, 2022
Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source

Infoga - Email OSINT Infoga is a tool gathering email accounts informations (ip,hostname,country,...) from different public source (search engines, pg

m4ll0k (mallok) 1.8k Jan 04, 2023
A repository to detect the ARP spoofing in any devices and prevent Man in the Middle(MITM) attack using Python3

arp_spoof_detector A repository to detect the ARP spoofing in any devices and prevent Man in the Middle(MITM) attack using Python3 Usage: git clone ht

Surya Das N 1 Oct 30, 2021
Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.

Dependency Combobulator Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage

Apiiro 84 Dec 23, 2022
TightVNC Vulnerability.

CVE-2022-23967 In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbprot

MaherAzzouzi 15 Jul 11, 2022
Growtopia Save.dat Stealer

savedat-stealer Growtopia Save.dat Stealer (Auto Send To Webhook) How To Use After Change Webhook URL Compile script to exe Give to target Done Info C

NumeX 9 May 01, 2022
Searches through git repositories for high entropy strings and secrets, digging deep into commit history

truffleHog Searches through git repositories for secrets, digging deep into commit history and branches. This is effective at finding secrets accident

Truffle Security 10.1k Jan 09, 2023
open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability

CVE-2021-44228-log4jVulnScanner-metasploit open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability pre

Taroballz 7 Nov 09, 2022