Filtered by vendor Tribe29
Subscribe
Total
42 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-28833 | 1 Tribe29 | 1 Checkmk | 2024-06-12 | N/A | 7.5 HIGH |
| Improper restriction of excessive authentication attempts with two factor authentication methods in Checkmk 2.3 before 2.3.0p6 facilitates brute-forcing of second factor mechanisms. | |||||
| CVE-2021-40905 | 1 Tribe29 | 1 Checkmk | 2024-05-17 | 6.8 MEDIUM | 8.8 HIGH |
| ** DISPUTED ** The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner. | |||||
| CVE-2023-31211 | 1 Tribe29 | 1 Checkmk | 2024-05-03 | N/A | 6.5 MEDIUM |
| Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials | |||||
| CVE-2023-6740 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 7.8 HIGH |
| Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges | |||||
| CVE-2023-6735 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 7.8 HIGH |
| Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges | |||||
| CVE-2023-6156 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 8.8 HIGH |
| Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. | |||||
| CVE-2023-31210 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 7.8 HIGH |
| Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries | |||||
| CVE-2023-23549 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 2.7 LOW |
| Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames. | |||||
| CVE-2023-6157 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 8.8 HIGH |
| Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. | |||||
| CVE-2023-6287 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2024-02-05 | N/A | 5.5 MEDIUM |
| Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files. | |||||
| CVE-2023-6251 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 3.5 LOW |
| Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users. | |||||
| CVE-2023-31209 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 8.8 HIGH |
| Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users. | |||||
| CVE-2023-23548 | 1 Tribe29 | 1 Checkmk | 2024-02-05 | N/A | 6.1 MEDIUM |
| Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | |||||
| CVE-2023-22359 | 1 Tribe29 | 1 Checkmk | 2024-02-04 | N/A | 4.3 MEDIUM |
| User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. | |||||
| CVE-2023-22318 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2024-02-04 | N/A | 7.5 HIGH |
| Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. | |||||
| CVE-2023-31207 | 1 Tribe29 | 1 Checkmk | 2024-02-04 | N/A | 5.5 MEDIUM |
| Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. | |||||
| CVE-2023-22348 | 1 Tribe29 | 1 Checkmk | 2024-02-04 | N/A | 4.3 MEDIUM |
| Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. | |||||
| CVE-2023-22309 | 1 Tribe29 | 1 Checkmk Appliance Firmware | 2024-02-04 | N/A | 6.1 MEDIUM |
| Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. | |||||
| CVE-2023-22288 | 1 Tribe29 | 1 Checkmk | 2024-02-04 | N/A | 5.4 MEDIUM |
| HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails | |||||
| CVE-2023-22294 | 1 Tribe29 | 1 Checkmk | 2024-02-04 | N/A | 8.8 HIGH |
| Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. | |||||