Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2024-6572

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-3506

Potentially senitive path exposed via unauthenticated http route

Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to access files that could contain secrets.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-2092

Remote site authentication secrets written to web log

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-2596

Session logout can be overwritten by long lasting request

Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-32917

Privilege escalation in jar_signature

Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access to JAVA_HOME/bin directory to escalate privileges.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-1712

Arbitrary file write with vcrtrace

Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2025-32918

Livestatus injection in autocomplete endpoint

Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-38865

Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for an event to originate from a host with the same contact group or from an event generated with an unknown host.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2023-31211

Disabled automation users could still authenticate

Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2023-6735

Privilege escalation in mk_tsm

Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2023-6740

Privilege escalation in jar_signature

Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2017-14955

check-mk: Mishandles certain errors within the failed-login save feature because of a race condition

Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.

CVSS 3.1 · 5.9 Medium EPSS 12.1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-4884

Path-Traversal in MKP storing

Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2023-0284

Improper validation of LDAP user IDs

Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2022-43440

Privilege escalation via manipulated unixcat executable

Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-46303

Command injection in SMS notifications

Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-48317

Insecure Termination of RestAPI Session Tokens

Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-48318

Insecure access control mechanisms for RestAPI documentation

No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-48320

CSRF in add-visual endpoint

Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-48319

Host secret disclosed in Checkmk logs

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk