CVE-2020-35488

The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.)

• CWE-502

• https://github.com/GuillaumePetit84/CVE-2020-35488Exploit, Mitigation, Third Party Advisory
• https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2Release Notes, Third Party Advisory
• https://github.com/GuillaumePetit84/CVE-2020-35488Exploit, Mitigation, Third Party Advisory
• https://gitlab.com/nxlog-public/nxlog-ce/-/blob/master/ChangeLog.txt#L2Release Notes, Third Party Advisory

Published

Jan 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35479MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php…6.1
• CVE-2020-3548A vulnerability in the Transport Layer Security (TLS) protoc…7.5
• CVE-2020-35480An issue was discovered in MediaWiki before 1.35.1. Missing …5.3
• CVE-2020-35481SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro…9.8
• CVE-2020-35482SolarWinds Serv-U before 15.2.2 allows authenticated reflect…5.4
• CVE-2020-35483AnyDesk before 6.1.0 on Windows, when run in portable mode o…7.8
• CVE-2020-35489The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 …10
• CVE-2020-3549A vulnerability in the sftunnel functionality of Cisco Firep…8.1
• CVE-2020-35490FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-35491FasterXML jackson-databind 2.x before 2.9.10.8 mishandles th…8.1
• CVE-2020-35492A flaw was found in cairo's image-compositor.c in all versio…7.8
• CVE-2020-35493A flaw exists in binutils in bfd/pef.c. An attacker who is a…5.5