Filtered by vendor Tribe29
Subscribe
Total
45 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-1768 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 5.3 MEDIUM |
| Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations. | |||||
| CVE-2023-31208 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 8.8 HIGH |
| Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. | |||||
| CVE-2023-22318 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2023-12-10 | N/A | 7.5 HIGH |
| Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. | |||||
| CVE-2023-22307 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2023-12-10 | N/A | 5.5 MEDIUM |
| Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files. | |||||
| CVE-2022-46302 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 8.8 HIGH |
| Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an attacker to perform remote code execution with root privileges on the underlying host. | |||||
| CVE-2023-22348 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 4.3 MEDIUM |
| Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. | |||||
| CVE-2023-22359 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 4.3 MEDIUM |
| User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. | |||||
| CVE-2023-0284 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 8.1 HIGH |
| Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected. | |||||
| CVE-2022-48318 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 5.3 MEDIUM |
| No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation. | |||||
| CVE-2022-48320 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 4.3 MEDIUM |
| Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages. | |||||
| CVE-2022-43440 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 7.8 HIGH |
| Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable | |||||
| CVE-2022-4884 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 4.9 MEDIUM |
| Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file. | |||||
| CVE-2022-46303 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 7.5 HIGH |
| Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within the context of the application's local permissions. | |||||
| CVE-2022-48319 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 5.5 MEDIUM |
| Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file. | |||||
| CVE-2022-48317 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | N/A | 9.8 CRITICAL |
| Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI. | |||||
| CVE-2022-24564 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user. | |||||
| CVE-2022-33912 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | 7.2 HIGH | 7.8 HIGH |
| A permission issue affects users that deployed the shipped version of the Checkmk Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Using the shipped version of the agents, the maintainer scripts located at /var/lib/dpkg/info/ will be owned by the user and the group with ID 1001. If such a user exists on the system, they can change the content of these files (which are then executed by root). This leads to a local privilege escalation on the monitored host. Version 1.6 through 1.6.9p29, version 2.0 through 2.0.0p26, version 2.1 through 2.1.0p3, and version 2.2.0i1 are affected. | |||||
| CVE-2021-40906 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication. | |||||
| CVE-2022-24565 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications. | |||||
| CVE-2022-24566 | 1 Tribe29 | 1 Checkmk | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting (XSS). | |||||