CVE-2022-24903

< 8.2204.1

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when oc

8.1HIGH

CVE-2011-1490

< 5.7.6

A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were us

5.5MEDIUM

CVE-2011-1489

< 5.7.6

A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were u

5.5MEDIUM

CVE-2011-1488

< 5.7.6

A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was

5.5MEDIUM

CVE-2019-17042

all versions

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log

9.8CRITICAL

CVE-2019-17041

all versions

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser fo

9.8CRITICAL

CVE-2019-17040

all versions

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.

9.8CRITICAL

CVE-2018-16881

< 8.27.0

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to

7.5HIGH

CVE-2018-1000140

<= 1.2.14

rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a pe

9.8CRITICAL

CVE-2017-12588

<= 8.27.0

The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a f

9.8CRITICAL

CVE-2015-3243

all versions

rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files

5.5MEDIUM

CVE-2014-3683

<= 7.6.6

Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a deni

CVE-2014-3634

<= 7.6.5

rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash

CVE-2013-4758

<= 7.4.1

Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and

CVE-2011-4623

all versions

Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x befo

CVE-2011-3200

all versions

Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and

CVE-2008-5618

all versions

imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an

CVE-2008-5617

all versions

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attac

CVE-2005-3074

<= 1.0.1_stable

SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL