CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3928 – Dromara open-capacity-platform auth-server heapdump information disclosure
https://notcve.org/view.php?id=CVE-2024-3928
A vulnerability was found in Dromara open-capacity-platform 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /actuator/heapdump of the component auth-server. The manipulation leads to information disclosure. The attack can be launched remotely. • https://github.com/ggfzx/OCP-Security-Misconfiguration/tree/main https://vuldb.com/?ctiid.261367 https://vuldb.com/?id.261367 https://vuldb.com/?submit.313847 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51389 – HertzBeat SnakeYAML Deser RCE
https://notcve.org/view.php?id=CVE-2023-51389
Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability. Hertzbeat es un sistema de monitorización en tiempo real. En la interfaz de `/define/yml`, SnakeYAML se usa como analizador para analizar el contenido yml, pero no se usa ninguna configuración de seguridad, lo que genera una vulnerabilidad de deserialización de YAML. • https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17 https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51388 – HertzBeat AviatorScript Inject RCE
https://notcve.org/view.php?id=CVE-2023-51388
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability. Hertzbeat es un sistema de monitorización en tiempo real. En `CalculateAlarm.java`, `AviatorEvaluator` se usa para ejecutar directamente la función de expresión y no se configura ninguna política de seguridad, lo que da como resultado la inyección de script AviatorScript (que puede ejecutar cualquier método estático de forma predeterminada). • https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2 https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51653 – Hertzbeat JMX JNDI RCE
https://notcve.org/view.php?id=CVE-2023-51653
Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect` is vulnerable to JNDI injection. The corresponding interface is `/api/monitor/detect`. If there is a URL field, the address will be used by default. When the URL is `service:jmx:rmi:///jndi/rmi://xxxxxxx:1099/localHikari`, it can be exploited to cause remote code execution. • https://github.com/dromara/hertzbeat/commit/f794b0d82be49c596c04a042976446559eb315ef https://github.com/dromara/hertzbeat/security/advisories/GHSA-gcmp-vf6v-59gg • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-51650 – Unauthorized access vulnerability on three interfaces
https://notcve.org/view.php?id=CVE-2023-51650
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue. Hertzbeat es un sistema de monitoreo en tiempo real de código abierto. • https://github.com/dromara/hertzbeat/releases/tag/v1.4.1 https://github.com/dromara/hertzbeat/security/advisories/GHSA-rrc5-qpxr-5jm2 • CWE-862: Missing Authorization •