Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2023-51388
9.8
CRITICALCVSS v3
Published
February 22, 2024
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
apache/hertzbeat
GitHubAn AI-powered next-generation open source real-time observability system.
GitHubAn AI-powered next-generation open source real-time observability system.< 1.4.1NVD