Syslog Ng
Monthly
SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).
syslog-ng is an enhanced log daemo. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).
syslog-ng is an enhanced log daemo. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.