Checkmk.

Trust of compromised eMudhra root CA in bundled CA stores

• Checkmk
• Weak cryptography or TLS
• CWE-1395

mk-oracle: Local privilege escalation via insecure Oracle Home library loading

• Checkmk
• CWE-426
• CWE-829

Open redirect and XSS via reset_url parameter

• Checkmk
• Open redirect

mk-oracle: Local privilege escalation via malicious Oracle Instant Client

• Checkmk
• CWE-426
• CWE-829

Livestatus injection via monitoring filter values

• Checkmk
• Other injection

Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

• Checkmk
• Hard-coded credentials

Missing decompression size limit in agent receiver allows memory exhaustion via push agent data

• Checkmk
• CWE-409

Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

• Checkmk
• Weak cryptography or TLS

Missing authorization for viewing background jobs

• Checkmk
• Broken access control

Agent receiver accepts mTLS requests without a client certificate

• Checkmk
• Authentication bypass

Frozen BI aggregations leak host and service names to unauthorized users

• Checkmk
• Broken access control

Missing Authorization Allows Editing of Foreign Reports

• Checkmk
• Broken access control

Fix Business Intelligence API Pack permission

• Checkmk
• Broken access control

mk_sap_hana: Privilege escalation via crafted sapstartsrv process name

• Checkmk
• Command injection

Fix XSS in service discovery active check output

• Checkmk
• Cross-site scripting (XSS)

XSS in urls

• Checkmk
• Cross-site scripting (XSS)

Fix stored XSS in global settings change log

• Checkmk
• Cross-site scripting (XSS)

User Messages widget leaked issuer messages on shared dashboards

• Checkmk
• Broken access control

Fix stored XSS in URL dashboard widget via dangerous URI schemes

• Checkmk
• Cross-site scripting (XSS)

Privilege escalation via mk_mysql agent plugin on Windows

• Checkmk
• CWE-427

Potential livestatus injection in prediction graph page

• Checkmk
• CWE-140

Potential livestatus injection in notification test

• Checkmk
• CWE-140

Livestatus injection in monitoring quicksearch

• Checkmk
• CWE-140

omd: Local privilege escalation when executing omd commands as root

• Checkmk
• CWE-426
• CWE-829

Cross-site scripting in dashlet title

• Checkmk
• Cross-site scripting (XSS)

Insufficient permission validation on multiple REST API Quick Setup endpoints

• Checkmk
• CWE-280

Stored cross-site scripting in Pending Changes sidebar

• Checkmk
• Cross-site scripting (XSS)

XSS in Unified Search via Unescaped Host/Service Names

• Checkmk
• Cross-site scripting (XSS)

Session hijacking via exposed session signing secret in distributed Checkmk setups

• Checkmk
• Hard-coded credentials

Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint

• Checkmk
• CWE-204

Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint

• Checkmk
• CWE-204

Deletion of passwords via RestApi

• Checkmk
• Broken access control

Cross-site scripting in HTML logs of Synthetic Monitoring test services

• Checkmk
• Cross-site scripting (XSS)

Missing Permission Check on Analyze Configuration Page

• Checkmk
• Broken access control

Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule

• Checkmk
• CWE-212

Insufficient permission validation when showing agent information

• Checkmk
• CWE-280

Insufficient permission validation on multiple REST API endpoints

• Checkmk
• CWE-280

Insufficient permission validation when configuring notification parameters

• Checkmk
• CWE-280

Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output

• Checkmk
• Broken access control

Cross Site Scripting through compromised remote site

• Checkmk
• Cross-site scripting (XSS)

Path-Traversal in report scheduler

• Checkmk
• Path traversal

Privilege Escalation in Windows License plugin for Checkmk Windows Agent

• Checkmk
• CWE-427

Sensitive form data in URL query parameters

• Checkmk
• CWE-598

Livestatus injection in autocomplete endpoint

• Checkmk
• CWE-140

Sensitive data exposed during automatic agent updates

• Checkmk
• Broken access control

Arbitrary file write with vcrtrace

• Checkmk
• Command injection

Privilege escalation in jar_signature

• Checkmk
• CWE-427

Potentially senitive path exposed via unauthenticated http route

• Checkmk
• Information disclosure

Remote site authentication secrets written to web log

• Checkmk
• Information disclosure

Livestatus command injection in RestAPI

• Checkmk
• CWE-140

Session logout can be overwritten by long lasting request

• Checkmk
• Authentication bypass

LDAP credentials logged to Apache error log

• Checkmk
• Information disclosure

User-Readable Private Key in Windows Agent

• Checkmk
• Broken access control

Logging of sitesecret to automations log

• Checkmk
• Information disclosure

CSRF token leaked in URL parameters

• Checkmk
• CWE-598

SNMP and IMPI secrets written to audit log

• Checkmk
• Information disclosure

Information leak in mknotifyd

• Checkmk
• Information disclosure

Fix 2FA bypass via RestAPI

• Checkmk
• Broken access control

Reflected links in error message facilitate phishing attacks

• Checkmk
• Cross-site scripting (XSS)

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'

• Checkmk
• CWE-322