{"uuid": "12e92810-4a7c-4187-b90a-258fe115e317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44228", "type": "seen", "source": "https://t.me/hacking_Attack/35591", "content": "Detects Log4J versions on your file-system within any application that are vulnerable (https://www.kitploit.com/search/label/Vulnerable) to CVE-2021-44228 (https://mergebase.com/vulnerability/CVE-2021-44228/)  and CVE-2021-45046 (https://mergebase.com/vulnerability/CVE-2021-45046/). It is able to even find instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!  Currently reports log4j-core versions 2.12.2 and 2.17.0 as _SAFE_, 2.15.0 and 2.16.0 as _OKAY_ and all other versions as _VULNERABLE_  (although it does report pre-2.0-beta9 as \"_POTENTIALLY_SAFE_\").  Can correctly detect log4j inside executable spring-boot jars/wars, dependencies blended  into uber jars (https://mergebase.com/blog/software-composition-analysis-sca-vs-java-uber-jars/), shaded jars, and even  exploded jar files just sitting uncompressed on the file-system (aka *.class).  We currently maintain a collection of log4j-samples (https://github.com/mergebase/log4j-samples) we use for testing.\n  Example Usage:  java -jar log4j-detector-2021.12.17.jar [path-to-scan] > hits.txt\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:03.081649Z"}