Page 6 of 46 results (0.002 seconds)

CVSS: 6.5EPSS: 0%CPEs: 105EXPL: 0

Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log file. • https://checkmk.com/werk/14916 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 5.3EPSS: 0%CPEs: 62EXPL: 0

No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation. • https://checkmk.com/werk/14509 • CWE-862: Missing Authorization •

CVSS: 9.8EPSS: 0%CPEs: 58EXPL: 0

Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI. • https://checkmk.com/werk/14485 • CWE-613: Insufficient Session Expiration •

CVSS: 6.8EPSS: 0%CPEs: 21EXPL: 1

Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. • https://checkmk.com/werk/14385 https://www.sonarsource.com/blog/checkmk-rce-chain-1 • CWE-20: Improper Input Validation CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 7.8EPSS: 0%CPEs: 102EXPL: 1

Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost. • https://checkmk.com/werk/14384 https://www.sonarsource.com/blog/checkmk-rce-chain-1 • CWE-20: Improper Input Validation •