Advisories · Technology
Checkmk.
Every CVE that names Checkmk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Cross-site scripting in Robotmk logs view
- Checkmk
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
XSS in view page with SLA column
- Checkmk
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
Privilege escalation in mk_informix plugin
- Checkmk
- CWE-272
- CWE-807
- CVSS 6.5 Medium
Livestatus injection in mknotifyd
- Checkmk
- CWE-140
- CVSS 8.8 High
1-Click compromize via CSRF
- Checkmk
- Cross-site request forgery (CSRF)
- CVSS 8.8 High
Privilege escalation in Windows agent
- Checkmk
- Broken access control
- CVSS 5.3 Medium
local IP restriction of internal HTTP endpoints
- Checkmk
- Authentication bypass
- CVSS 6.5 Medium
XSS in SQL check parameters
- Checkmk
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Reflected links in visuals facilitate phishing attacks
- Checkmk
- Cross-site scripting (XSS)
- CVSS 2.7 Low
Automation user secrets written to audit log
- Checkmk
- Information disclosure
- CVSS 4.8 Medium
XSS in Crash Report Page
- Checkmk
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
XSS in confirmation pop-up
- Checkmk
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
XSS in inventory view
- Checkmk
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Missing brute-force protection for two factor authentication
- Checkmk
- Authentication bypass
- CVSS 8.8 High
Unrestricted upload and download paths in check_sftp
- Checkmk
- Path traversal
- CVSS 5.9 Medium
Brute-force protection ineffective for some login methods
- Checkmk
- Authentication bypass
- CVSS 6.5 Medium
Argument injection to runmqsc
- Checkmk
- Command injection
- CVSS 4.6 Medium
XSS in graph rendering
- Checkmk
- Cross-site scripting (XSS)
- CVSS 8.8 High
Privilege escalation in mk_informix plugin
- Checkmk
- CWE-272
- CWE-807
- CVSS 3.8 Low
Information disclosure in mk_oracle Checkmk agent plugin
- Checkmk
- CWE-214
- CVSS 8.2 High
Privilege escalation in mk_oracle plugins
- Checkmk
- CWE-272
- CVSS 8.8 High
Privilege escalation in windows agent
- Checkmk
- CWE-427
- CVSS 8.8 High
Privilege escalation in jar_signature
- Checkmk
- CWE-427
- CVSS 8.8 High
Privilege escalation in mk_tsm
- Checkmk
- Code injection
- CVSS 8.8 High
Disabled automation users could still authenticate
- Checkmk
- Authentication bypass
- CVSS 8.8 High
Privilege escalation in agent via LD_LIBRARY_PATH
- Checkmk
- CWE-427
- CVSS 3.5 Low
CSRF in delete_user_message
- Checkmk
- Cross-site request forgery (CSRF)
- CVSS 7.6 High
Livestatus injection in ajax_search
- Checkmk
- CWE-140
- CVSS 7.6 High
Livestatus injection in availability timeline
- Checkmk
- CWE-140
- CVSS 2.7 Low
DoS via long hostnames
- Checkmk
- CWE-1284
- CVSS 8.8 High
Command injection via active checks and REST API
- Checkmk
- Command injection
- CVSS 5.4 Medium
XSS in business intelligence
- Checkmk
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Reading host_configs does not honour contact groups
- Checkmk
- Broken access control
- CVSS 8.3 High
Livestatus command injection in RestAPI
- Checkmk
- CWE-140