| CVE-2024-28825 | CRÍTICO9.8 | Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta), 2.2.0p26, 2.1.0p43, and in Checkmk 2.0.0 (EOL) facilitates password brute-forcing. | 24/04/2024 |
| CVE-2024-3367 | MEDIO5.5 | Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p26 and <2.3.0b5 allows local attacker to inject one argument to runmqsc | 16/04/2024 |
| CVE-2024-2380 | MEDIO5.4 | Stored XSS in graph rendering in Checkmk <2.3.0b4. | 05/04/2024 |
| CVE-2024-28824 | ALTO7.8 | Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges. | 22/03/2024 |
| CVE-2024-1742 | BAJO3.3 | Invocation of the sqlplus command with sensitive information in the command line in the mk_oracle Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows the extraction of this information from the process list. | 22/03/2024 |
| CVE-2024-0638 | MEDIO6.7 | Least privilege violation in the Checkmk agent plugins mk_oracle, mk_oracle.ps1, and mk_oracle_crs before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges. | 22/03/2024 |
| CVE-2024-0670 | ALTO7.8 | Privilege escalation in windows agent plugin in Checkmk before 2.2.0p23, 2.1.0p40 and 2.0.0 (EOL) allows local user to escalate privileges | 11/03/2024 |
| CVE-2023-6740 | ALTO7.8 | Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges | 12/01/2024 |
| CVE-2023-6735 | ALTO7.8 | Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges | 12/01/2024 |
| CVE-2023-31211 | MEDIO6.5 | Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credentials | 12/01/2024 |
| CVE-2023-31210 | ALTO7.8 | Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries | 13/12/2023 |
| CVE-2023-6251 | BAJO3.5 | Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users. | 24/11/2023 |
| CVE-2023-6157 | ALTO8.8 | Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. | 22/11/2023 |
| CVE-2023-6156 | ALTO8.8 | Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command execution for authorized users. | 22/11/2023 |
| CVE-2023-23549 | BAJO2.7 | Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames. | 15/11/2023 |
| CVE-2023-31209 | ALTO8.8 | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users. | 10/08/2023 |
| CVE-2023-23548 | MEDIO6.1 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | 01/08/2023 |
| CVE-2023-22359 | MEDIO4.3 | User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. | 26/06/2023 |
| CVE-2023-22348 | MEDIO4.3 | Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. | 17/05/2023 |
| CVE-2023-31208 | ALTO8.8 | Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. | 17/05/2023 |