Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2023-51653

Hertzbeat JMX JNDI RCE

Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. Version 1.4.1 contains a fix for this issue.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Apache Dromara
Products
Hertzbeat Hertzbeat
CVE-2024-42362

GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Apache Dromara
Products
Hertzbeat Hertzbeat