New log4j 1.x vulnerabilities is warning about new log4j vulnerabilities:


CVE-2022-23302 is a high severity deserialization vulnerability in JMSSink. JMSSink uses JNDI in an unprotected manner allowing any application using the JMSSink to be vulnerable if it is configured to reference an untrusted site or if the site referenced can be accesseed by the attacker. For example, the attacker can cause remote code execution by manipulating the data in the LDAP store. 


CVE-2022-23305 is a high serverity SQL injection flaw in JDBCAppender that allows the data being logged to modify the behavior of the component. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. 


CVE-2022-23307 is a critical severity against the chainsaw component in Log4j 1.x. This is the same issue corrected in CVE-2020-9493 fixed in Chainsaw 2.1.0 but Chainsaw was included as part of Log4j 1.2.x.

iPhone iOS SMB CIFS connection

How to establish a SMB CIFS connection from your iOS device (iPhone or iPad), for example to your NAS storage system or some other network share:

  1. Open the "files-app"
    iOS files app
  2. Select the three dots in the upper right corner
  3. Select "connect to server" (in german "Mit Server verbinden"):iOS files connect with server Mit Server verbinden 
  4. Enter your SMB CIFS destination as IPv4 address or FQDN:iOS files SMB CIFS

Almost perfect protection for websites and other services - Mutual TLS

Its hard to secure your IT services and applications. The list of possible attacks is long, as shown in the Mitre Att&ck framework , the...