Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2023-22288

Email HTML Injection

HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2024-0670

Privilege escalation in windows agent

Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Microsoft
Products
Checkmk Windows
CVE-2023-1768

Symmetric agent data encryption fails silently

Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2023-2020

Unauthorized scheduling of downtimes via REST API

Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2022-46302

Remote Code Execution with Root Privileges via Broad Apache Permissions

Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2023-31207

Automation user secret logged to Apache access log

Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2023-22348

Reading host_configs does not honour contact groups

Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2023-31208

Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2024-38860

Reflected links in error message facilitate phishing attacks

Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phishing attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-28825

Brute-force protection ineffective for some login methods

Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2.0.0 (EOL) facilitates password brute-forcing.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-3367

Argument injection to runmqsc

Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p26 and <2.3.0b5 allows local attacker to inject one argument to runmqsc

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-2380

XSS in graph rendering

Stored XSS in graph rendering in Checkmk <2.3.0b4.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-0638

Privilege escalation in mk_oracle plugins

Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-1742

Information disclosure in mk_oracle Checkmk agent plugin

Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-28824

Privilege escalation in mk_informix plugin

Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk Tribe29
Products
Checkmk Checkmk
CVE-2024-28826

Unrestricted upload and download paths in check_sftp

Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-28831

XSS in confirmation pop-up

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-28832

XSS in Crash Report Page

Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows users with permission to change Global Settings to execute arbitrary scripts by injecting HTML elements into the Crash Report URL in the Global Settings.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-28830

Automation user secrets written to audit log

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user secrets to be written to audit log files accessible to administrators.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2024-38857

Reflected links in visuals facilitate phishing attacks

Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk