CVE-2024-42361

CVE-2024-42361 affects Hertzbeat, versions 1.6.0 and earlier. The vulnerability stems from an endpoint under /api/monitor/{monitorId}/metric/{metricFull} that builds and executes a SQL query using user-controlled data, due to a lack of validation. Reported impact includes potential SQL injection ...

CVE-2023-51653

CVE-2023-51653 affects Hertzbeat real-time monitoring when using JmxCollectImpl.java; the vulnerability arises from JMXConnectorFactory.connect allowing a JNDI injection via the vulnerable URL in the /api/monitor/detect interface. If a URL like service:jmx:rmi:///jndi/rmi://xxxxxx:1099/localHikar...

CVE-2024-42362

CVE-2024-42362 affects Hertzbeat, an open-source real-time monitoring system. It describes an authenticated (user role) remote-code-execution vulnerability via unsafe deserialization in /api/monitors/import. The issue is classified with a high impact (CVSS v3.1: 8.8) affecting confidentiality, in...

CVE-2024-42323

Apache HertzBeat versions prior to 1.6.0 are vulnerable to Remote Code Execution (RCE) due to insecure deserialization in the SnakeYaml library. An authenticated attacker can exploit this by importing YAML files through the /api/monitors/import and /api/alert/defines/import endpoints. By submitti...

CVE-2023-51389

CVE-2023-51389 affects Hertzbeat, a real-time monitoring system. The vulnerability resides at the /define/yml interface, where SnakeYAML is used to parse YAML without a security configuration, enabling YAML deserialization. Affects versions prior to 1.4.1; version 1.4.1 fixes the issue. The issue...

CVE-2023-51388

Hertzbeat real-time monitoring software is affected by CVE-2023-51388 due to direct execution of expressions in CalculateAlarm.java via AviatorEvaluator without a security policy, enabling AviatorScript injection. The issue is tied to Hertzbeat versions prior to 1.4.1; upgrading to version 1.4.1 ...

CVE-2024-41151

Apache HertzBeat versions prior to 1.6.1 are vulnerable to a deserialization of untrusted data flaw. This vulnerability can be exploited by an authorized attacker to achieve code execution on the target system. To remediate this issue, users are recommended to upgrade to version 1.6.1 .

CVE-2024-45791

Apache HertzBeat versions prior to 1.6.1 are vulnerable to an information disclosure flaw (CWE-200) that allows an unauthorized actor to obtain sensitive token information . The vulnerability can be exploited via an HTTP GET method using a query string. To remediate this issue, users are recommen...

CVE-2024-45505

A command injection vulnerability exists in Apache HertzBeat (incubating) versions prior to 1.6.1 . The root cause is the application's failure to properly filter special characters and commands, which could allow an authorized attacker to execute arbitrary commands on the system. To remediate th...

CVE-2024-56736

Apache HertzBeat (incubating) versions prior to 1.7.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the Api Config Oss component. This flaw allows an attacker to potentially induce the server to make unintended requests. To remediate this issue, users are recommended...

CVE-2023-51387

CVE-2023-51387 affects Hertzbeat before v1.4.1, where improper sanitization of alert expressions in the aviatorscript evaluation path allows a user with access to the alert define function to execute arbitrary commands on the Hertzbeat server. The root cause is input sanitization in alert express...

CVE-2022-39337

CVE-2022-39337 affects Hertzbeat, a real-time monitoring system. The vulnerability is a permission bypass in versions up to 1.20, allowing bypass of system authentication and invocation of interfaces without authorization. The issue’s root cause is implied to be improper access control in older r...

CVE-2023-51650

CVE-2023-51650 affects Hertzbeat prior to version 1.4.1, due to Spring Boot permission configuration issues that enable unauthorized access to three interfaces and may disclose sensitive server information. The issue is fixed in v1.4.1. No exploitation details are provided in the available docume...

CVE-2026-24343

Apache HertzBeat versions 1.7.1 through 1.7.9 (specifically before 1.8.0) are vulnerable to an XPath Injection flaw caused by improper neutralization of data within XPath expressions. This vulnerability can be exploited using crafted XPath expressions to cause uncontrolled resource consumption . ...

CVE-2025-48208

CVE-2025-48208 describes an LDAP Injection vulnerability in Apache HertzBeat up to version 1.7.2. An attacker with an authenticated account can trigger the flaw by crafting custom LDAP queries, potentially resulting in arbitrary script execution. Remediation: upgrade to version 1.7.3 (fixes the i...

CVE-2025-24404

Apache HertzBeat (incubating) before 1.7.0 is affected by an XML Injection RCE vulnerability that occurs when an authenticated attacker adds a monitor that parses an XML sitemap response and returns specially crafted content. The issue can lead to remote code execution and impacts confidentiality...