Apache Log4Net vulnerabilities

CVE-2018-1285 [CRITICAL] CWE-611 CVE-2018-1285: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net conf Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

CVE-2006-0743 [MEDIUM] CWE-134 CVE-2006-0743: Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attack Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.