Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ApacheHertzbeat*

9 matches found

CVE
CVE•added 2024/02/22 4:15 p.m.•84 views

CVE-2023-51653

Hertzbeat is a real-time monitoring system. In the implementation of JmxCollectImpl.java, JMXConnectorFactory.connect is vulnerable to JNDI injection. The corresponding interface is /api/monitor/detect. If there is a URL field, the address will be used by default. When the URL is service:jmx:rmi://...

9.8CVSS9.9AI score0.04467EPSS
CVE
CVE•added 2024/08/20 9:15 p.m.•67 views

CVE-2024-42362

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

8.8CVSS8.6AI score0.00324EPSS
CVE
CVE•added 2024/08/20 9:15 p.m.•66 views

CVE-2024-42361

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.

9.8CVSS7.9AI score0.0055EPSS
CVE
CVE•added 2024/02/22 4:15 p.m.•52 views

CVE-2023-51389

Hertzbeat is a real-time monitoring system. At the interface of /define/yml, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

9.8CVSS9.6AI score0.00489EPSS
CVE
CVE•added 2024/09/21 10:15 a.m.•52 views

CVE-2024-42323

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers.This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.

8.8CVSS8.7AI score0.58722EPSS
CVE
CVE•added 2024/02/22 4:15 p.m.•50 views

CVE-2023-51388

Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vuln...

9.8CVSS9.8AI score0.00575EPSS
CVE
CVE•added 2024/11/18 9:15 a.m.•50 views

CVE-2024-45505

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers.This issue affects Apache HertzBeat (incubating): before 1.6.1. Users are recommended to upgrade to ve...

8.8CVSS8.8AI score0.01069EPSS
CVE
CVE•added 2024/11/18 9:15 a.m.•46 views

CVE-2024-45791

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

7.5CVSS7.5AI score0.00167EPSS
CVE
CVE•added 2024/11/18 9:15 a.m.•45 views

CVE-2024-41151

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue.

8.8CVSS8.7AI score0.00649EPSS