CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2020-24908
https://notcve.org/view.php?id=CVE-2020-24908
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory. Checkmk versiones anteriores a 1.6.0p17, permite a usuarios locales alcanzar privilegios SYSTEM por medio de un script de shell de tipo caballo de Troya en el directorio %PROGRAMDATA%\checkmk\agent\local • https://compass-security.com/fileadmin/Research/Advisories/2020-05_CSNC-2020-005_Checkmk_Local_Privilege_Escalation.txt •
CVSS: 5.9EPSS: 1%CPEs: 19EXPL: 1CVE-2017-14955 – Check_MK 1.2.8p25 - Information Disclosure
https://notcve.org/view.php?id=CVE-2017-14955
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report. Check_MK en versiones anteriores a la 1.2.8p26 gestiona de manera incorrecta determinados errores en la característica de guardado de intentos fallidos de inicio de sesión por culpa de una condición de carrera que permite que los atacantes remotos obtengan información sensible de usuarios leyendo un informe de cierre inesperado de la interfaz gráfica de usuario. Check_mk versions 1.2.8p25 and below suffer from a save_users() race condition that leads to sensitive information disclosure. • https://www.exploit-db.com/exploits/43021 http://mathias-kettner.com/check_mk_werks.php?edition_id=raw&branch=1.2.8 https://mathias-kettner.de/check_mk_werks.php?werk_id=5208&HTML=yes • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •