Filtered by vendor Checkmk Subscriptions
Filtered by product Checkmk Subscriptions
Total 56 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-31210 1 Checkmk 1 Checkmk 2024-08-02 8.8 High
Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries
CVE-2023-31208 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 8.3 High
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.
CVE-2023-31207 1 Checkmk 1 Checkmk 2024-08-02 4.4 Medium
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
CVE-2023-22348 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 4.3 Medium
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.
CVE-2023-22288 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 6.8 Medium
HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails
CVE-2023-6740 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 8.8 High
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
CVE-2023-6251 1 Checkmk 1 Checkmk 2024-08-02 3.5 Low
Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users.
CVE-2023-6157 1 Checkmk 1 Checkmk 2024-08-02 7.6 High
Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
CVE-2023-6156 1 Checkmk 1 Checkmk 2024-08-02 7.6 High
Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users.
CVE-2023-2020 1 Checkmk 1 Checkmk 2024-08-02 4.3 Medium
Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host.
CVE-2023-1768 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 3.7 Low
Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations.
CVE-2023-0284 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-02 6.8 Medium
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.
CVE-2024-28825 1 Checkmk 1 Checkmk 2024-08-02 5.9 Medium
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2.0.0 (EOL) facilitates password brute-forcing.
CVE-2024-28833 1 Checkmk 1 Checkmk 2024-08-02 5.9 Medium
Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms.
CVE-2024-28827 1 Checkmk 1 Checkmk 2024-08-02 8.8 High
Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker to gain SYSTEM privileges.
CVE-2024-28826 1 Checkmk 1 Checkmk 2024-08-02 8.8 High
Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.