https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:03:05 +0000 https://cve.radiocsirt.org/vuln/cve-2025-54812 <p><strong>Affected:</strong> Apache Software Foundation Apache Log4cxx</p> <p>Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.</p> <p>When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur:</p> <p>* Log4cxx is configured to use HTMLLayout.</p> <p>* Logger name comes from an untrusted string</p> <p>* Logger with compromised name logs a message</p> <p>* User opens the generated HTML log file in their browser, leading to potential XSS</p> <p>Because logger names are generally constant strings, we assess the impact to users as LOW</p> <p>This issue affects Apache Log4cxx: before 1.5.0.</p> <p>Users are recommended to upgrade to version 1.5.0, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Log4cxx</p> <p>Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.</p> <p>When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur:</p> <p>* Log4cxx is configured to use HTMLLayout.</p> <p>* Logger name comes from an untrusted string</p> <p>* Logger with compromised name logs a message</p> <p>* User opens the generated HTML log file in their browser, leading to potential XSS</p> <p>Because logger names are generally constant strings, we assess the impact to users as LOW</p> <p>This issue affects Apache Log4cxx: before 1.5.0.</p> <p>Users are recommended to upgrade to version 1.5.0, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2025-54812