Page 6 of 34 results (0.006 seconds)

CVSS: 2.7EPSS: 0%CPEs: 118EXPL: 0

CVE-2023-23549 – DoS via long hostnames

https://notcve.org/view.php?id=CVE-2023-23549

Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames. La validación de entrada inadecuada en Checkmk &lt;2.2.0p15, &lt;2.1.0p37, &lt;=2.0.0p39 permite a atacantes privilegiados provocar una denegación parcial de servicio de la interfaz de usuario a través de nombres de host demasiado largos. • https://checkmk.com/werk/16219 • CWE-20: Improper Input Validation CWE-1284: Improper Validation of Specified Quantity in Input •

CVSS: 8.8EPSS: 0%CPEs: 102EXPL: 0

CVE-2023-31209 – Command injection via active checks and REST API

https://notcve.org/view.php?id=CVE-2023-31209

Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users. • https://checkmk.com/werk/15194 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 6.1EPSS: 0%CPEs: 106EXPL: 0

CVE-2023-23548 – XSS in business intelligence

https://notcve.org/view.php?id=CVE-2023-23548

Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. • https://checkmk.com/werk/15691 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •

CVSS: 4.3EPSS: 0%CPEs: 45EXPL: 0

CVE-2023-22348 – Reading host_configs does not honour contact groups

https://notcve.org/view.php?id=CVE-2023-22348

Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. • https://checkmk.com/werk/13982 • CWE-285: Improper Authorization •

CVSS: 8.8EPSS: 0%CPEs: 90EXPL: 0

CVE-2023-31208 – Livestatus command injection in RestAPI

https://notcve.org/view.php?id=CVE-2023-31208

Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. • https://checkmk.com/werk/15191 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-140: Improper Neutralization of Delimiters •