Filtered by vendor Checkmk Subscriptions
Filtered by product Checkmk Subscriptions
Total 56 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-6747 1 Checkmk 1 Checkmk 2024-10-15 5.3 Medium
Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data
CVE-2024-8606 1 Checkmk 1 Checkmk 2024-09-30 8.8 High
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication
CVE-2023-23548 1 Checkmk 1 Checkmk 2024-09-27 5.4 Medium
Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30.
CVE-2024-6052 1 Checkmk 1 Checkmk 2024-09-16 6.5 Medium
Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements
CVE-2024-6572 1 Checkmk 1 Checkmk 2024-09-09 7.4 High
Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic
CVE-2024-38858 1 Checkmk 1 Checkmk 2024-09-04 6.1 Medium
Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view.
CVE-2023-22359 1 Checkmk 1 Checkmk 2024-08-28 4.3 Medium
User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.
CVE-2023-23549 1 Checkmk 1 Checkmk 2024-08-28 2.7 Low
Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
CVE-2023-31209 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-28 8.8 High
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users.
CVE-2023-6735 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-26 8.8 High
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges
CVE-2023-31211 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-26 8.8 High
Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials
CVE-2024-28829 1 Checkmk 1 Checkmk 2024-08-21 N/A
Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL) allows local users to escalate privileges.
CVE-2024-6163 1 Checkmk 1 Checkmk 2024-08-20 5.3 Medium
Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data
CVE-2024-5741 1 Checkmk 1 Checkmk 2024-08-16 6.5 Medium
Stored XSS in inventory tree rendering in Checkmk before 2.3.0p7, 2.2.0p28, 2.1.0p45 and 2.0.0 (EOL)
CVE-2024-6542 1 Checkmk 1 Checkmk 2024-08-14 6.5 Medium
Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows arbitrary livestatus command execution.
CVE-2024-28828 1 Checkmk 1 Checkmk 2024-08-07 8.8 High
Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click compromize of the site.
CVE-2017-14955 1 Checkmk 1 Checkmk 2024-08-05 5.9 Medium
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report.
CVE-2020-28919 1 Checkmk 1 Checkmk 2024-08-04 5.4 Medium
A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title.
CVE-2020-24908 1 Checkmk 1 Checkmk 2024-08-04 7.8 High
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.
CVE-2021-40905 2 Checkmk, Tribe29 2 Checkmk, Checkmk 2024-08-04 8.8 High
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner