Advisories · Technology
Tribe29 Checkmk.
Every CVE that names Tribe29 Checkmk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
User-enumeration in RestAPI
- Tribe29 Checkmk
- Information disclosure
- CVSS 4.4 Medium
Automation user secret logged to Apache access log
- Tribe29 Checkmk
- Information disclosure
- CVSS 8.8 High
Remote Code Execution with Root Privileges via Broad Apache Permissions
- Tribe29 Checkmk
- CWE-829
- CVSS 4.3 Medium
Unauthorized scheduling of downtimes via REST API
- Tribe29 Checkmk
- CWE-280
- CVSS 3.7 Low
Symmetric agent data encryption fails silently
- Tribe29 Checkmk
- CWE-446
- CVSS 6.8 Medium
Email HTML Injection
- Tribe29 Checkmk
- CWE-138
- CVSS 5.4 Medium
CSRF in add-visual endpoint
- Tribe29 Checkmk
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
Host secret disclosed in Checkmk logs
- Tribe29 Checkmk
- Information disclosure
- CVSS 5.3 Medium
Insecure access control mechanisms for RestAPI documentation
- Tribe29 Checkmk
- Broken access control
- CVSS 5.6 Medium
Insecure Termination of RestAPI Session Tokens
- Tribe29 Checkmk
- Authentication bypass
- CVSS 6.8 Medium
SSRF in agent-receiver API
- Tribe29 Checkmk
- CWE-20
- CVSS 6.8 Medium
LQL Injection in Livestatus HTTP headers
- Tribe29 Checkmk
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
PHP code injection in watolib
- Tribe29 Checkmk
- CWE-20
- CVSS 8.0 High
Command injection in SMS notifications
- Tribe29 Checkmk
- CWE-20
- CVSS 8.8 High
Privilege escalation via manipulated unixcat executable
- Tribe29 Checkmk
- CWE-427
- CVSS 6.8 Medium
Improper validation of LDAP user IDs
- Tribe29 Checkmk
- CWE-20
- CVSS 3.5 Low
Path-Traversal in MKP storing
- Tribe29 Checkmk
- Path traversal