CVE-2023-6740 | High | 8.8 | 2024-01-12 | Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges |
CVE-2023-6735 | High | 8.8 | 2024-01-12 | Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges |
CVE-2023-31211 | High | 8.8 | 2024-01-12 | Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials |
CVE-2023-6287 | Low | 3.3 | 2023-11-27 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-31209 | High | 8.8 | 2023-08-10 | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated u… |
CVE-2023-22359 | Medium | 4.3 | 2023-06-26 | User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. |
CVE-2023-22348 | Medium | 4.3 | 2023-05-17 | Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. |
CVE-2023-31208 | High | 8.3 | 2023-05-17 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus com… |
CVE-2023-22318 | High | 7.5 | 2023-05-15 | Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. |
CVE-2023-31207 | Medium | 4.4 | 2023-05-02 | Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be wri… |
CVE-2023-22309 | Medium | 6.1 | 2023-04-20 | Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. |
CVE-2022-46302 | High | 8.8 | 2023-04-20 | Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe… |
CVE-2023-22307 | Medium | 5.5 | 2023-04-18 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-22294 | High | 8.8 | 2023-04-18 | Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. |
CVE-2023-2020 | Medium | 4.3 | 2023-04-18 | Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. |
CVE-2023-1768 | Low | 3.7 | 2023-04-04 | Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption… |
CVE-2023-22288 | Medium | 4.1 | 2023-03-20 | HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML int… |
CVE-2022-48321 | Medium | 6.8 | 2023-02-20 | Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted e… |
CVE-2022-48320 | Medium | 5.4 | 2023-02-20 | Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new v… |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2022-48318 | Medium | 5.3 | 2023-02-20 | No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information discl… |
CVE-2022-48317 | Medium | 5.6 | 2023-02-20 | Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired sess… |
CVE-2022-47909 | Medium | 6.8 | 2023-02-20 | Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk… |
CVE-2022-46836 | Critical | 9.1 | 2023-02-20 | PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to in… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2022-43440 | High | 8.8 | 2023-02-09 | Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site us… |
CVE-2023-0284 | Medium | 6.8 | 2023-01-26 | Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1… |
CVE-2022-4884 | Low | 3.5 | 2023-01-09 | Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious m… |
CVE-2022-33912 | High | 7.8 | 2022-06-17 | A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions onl… |
CVE-2022-31258 | High | 8.2 | 2022-05-20 | In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink. |
CVE-2021-40906 | Medium | 6.1 | 2022-03-25 | CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflecte… |
CVE-2021-40905 | High | 8.8 | 2022-03-25 | The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extens… |