CVE-2023-51653

CVE-2023-51653 affects Hertzbeat real-time monitoring when using JmxCollectImpl.java; the vulnerability arises from JMXConnectorFactory.connect allowing a JNDI injection via the vulnerable URL in the /api/monitor/detect interface. If a URL like service:jmx:rmi:///jndi/rmi://xxxxxx:1099/localHikar...

CVE-2024-42362

CVE-2024-42362 affects Hertzbeat, an open-source real-time monitoring system. It describes an authenticated (user role) remote-code-execution vulnerability via unsafe deserialization in /api/monitors/import. The issue is classified with a high impact (CVSS v3.1: 8.8) affecting confidentiality, in...

CVE-2024-42361

CVE-2024-42361 affects Hertzbeat, versions 1.6.0 and earlier. The vulnerability stems from an endpoint under /api/monitor/{monitorId}/metric/{metricFull} that builds and executes a SQL query using user-controlled data, due to a lack of validation. Reported impact includes potential SQL injection ...

CVE-2023-51389

CVE-2023-51389 affects Hertzbeat, a real-time monitoring system. The vulnerability resides at the /define/yml interface, where SnakeYAML is used to parse YAML without a security configuration, enabling YAML deserialization. Affects versions prior to 1.4.1; version 1.4.1 fixes the issue. The issue...

CVE-2024-42323

Apache HertzBeat (incubating) before version 1.6.0 is affected by a SnakeYAML deserialization vulnerability that enables remote code execution. The issue stems from insecure deserialization of YAML/XML data and is exploitable by authorized attackers. Upgrade to 1.6.0 to fix the issue.

CVE-2023-51388

Hertzbeat real-time monitoring software is affected by CVE-2023-51388 due to direct execution of expressions in CalculateAlarm.java via AviatorEvaluator without a security policy, enabling AviatorScript injection. The issue is tied to Hertzbeat versions prior to 1.4.1; upgrading to version 1.4.1 ...

CVE-2024-45791

CVE-2024-45791 describes an information disclosure in Apache HertzBeat prior to version 1.6.1. The vulnerability exposes sensitive information to unauthorized actors and is addressed by upgrading to HertzBeat 1.6.1. The public documentation in multiple sources (NVD/NVD mirror, Red Hat advisory, C...

CVE-2024-56736

The CVE-2024-56736 entry describes a Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat (incubating) affecting versions before 1.7.0. The vulnerability is tied to the Api Config Oss component, with the underlying issue enabling unauthorized server-side requests. Impact details i...

CVE-2024-41151

CVE-2024-41151 : Apache HertzBeat (prior to 1.6.1) contains a deserialization of untrusted data vulnerability. The issue can be exploited by authorized users to achieve code execution, with a CVSSv3.1 base score of 8.8 (HIGH) and network access requiring low privileges and no user interaction. Th...

CVE-2024-45505

CVE-2024-45505 concerns Apache HertzBeat (incubating) prior to 1.6.1, where an improper neutralization of special elements enables a Command Injection. The vulnerability affects execution paths that process constructed commands, allowing an attacker with network access (and with low privileges) t...

CVE-2022-39337

CVE-2022-39337 affects Hertzbeat, a real-time monitoring system. The vulnerability is a permission bypass in versions up to 1.20, allowing bypass of system authentication and invocation of interfaces without authorization. The issue’s root cause is implied to be improper access control in older r...

CVE-2023-51387

CVE-2023-51387 affects Hertzbeat before v1.4.1, where improper sanitization of alert expressions in the aviatorscript evaluation path allows a user with access to the alert define function to execute arbitrary commands on the Hertzbeat server. The root cause is input sanitization in alert express...

CVE-2023-51650

CVE-2023-51650 affects Hertzbeat prior to version 1.4.1, due to Spring Boot permission configuration issues that enable unauthorized access to three interfaces and may disclose sensitive server information. The issue is fixed in v1.4.1. No exploitation details are provided in the available docume...

CVE-2025-24404

Apache HertzBeat (incubating) before 1.7.0 is affected by an XML Injection RCE vulnerability that occurs when an authenticated attacker adds a monitor that parses an XML sitemap response and returns specially crafted content. The issue can lead to remote code execution and impacts confidentiality...

CVE-2026-24343

CVE-2026-24343 affects Apache HertzBeat up to 1.7.9; fixed in 1.8.0. The flaw is an improper neutralization of data within XPath expressions, i.e., an XPath Injection that can cause uncontrolled resource consumption. Affected versions: 1.7.1–1.7.9. Impact metrics indicate high risk (Network attac...

CVE-2025-48208

CVE-2025-48208 describes an LDAP Injection vulnerability in Apache HertzBeat up to version 1.7.2. An attacker with an authenticated account can trigger the flaw by crafting custom LDAP queries, potentially resulting in arbitrary script execution. Remediation: upgrade to version 1.7.3 (fixes the i...