https://vulnogram.org/ Most recent CVEs assigned by tribe29 (tribe29). https://vulnogram.org/seaview/icons/tribe29.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2023-31209 https://vulnogram.org/CVE-2023-31209 Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrary command execution for authenticated users. High Thu, 10 Aug 2023 08:14:12 GMT https://vulnogram.org/CVE-2023-23548 https://vulnogram.org/CVE-2023-23548 Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. Medium Tue, 01 Aug 2023 09:42:58 GMT https://vulnogram.org/CVE-2023-22359 https://vulnogram.org/CVE-2023-22359 User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. Medium Mon, 26 Jun 2023 06:51:24 GMT https://vulnogram.org/CVE-2023-22348 https://vulnogram.org/CVE-2023-22348 Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs. Medium Wed, 17 May 2023 15:51:54 GMT https://vulnogram.org/CVE-2023-31208 https://vulnogram.org/CVE-2023-31208 Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users. High Wed, 17 May 2023 08:24:59 GMT https://vulnogram.org/CVE-2023-22318 https://vulnogram.org/CVE-2023-22318 Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. High Mon, 15 May 2023 08:34:43 GMT https://vulnogram.org/CVE-2023-31207 https://vulnogram.org/CVE-2023-31207 Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log. Medium Tue, 02 May 2023 08:52:31 GMT https://vulnogram.org/CVE-2022-46302 https://vulnogram.org/CVE-2022-46302 Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allow… High Thu, 20 Apr 2023 13:06:30 GMT https://vulnogram.org/CVE-2023-22309 https://vulnogram.org/CVE-2023-22309 Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4. Medium Thu, 20 Apr 2023 13:05:27 GMT https://vulnogram.org/CVE-2023-22294 https://vulnogram.org/CVE-2023-22294 Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions. High Tue, 18 Apr 2023 18:59:33 GMT https://vulnogram.org/CVE-2023-22307 https://vulnogram.org/CVE-2023-22307 Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log files. Medium Tue, 18 Apr 2023 18:57:53 GMT https://vulnogram.org/CVE-2023-2020 https://vulnogram.org/CVE-2023-2020 Insufficient permission checks in the REST API in Tribe29 Checkmk <= 2.1.0p27 and <= 2.2.0b4 (beta) allow unauthorized users to schedule downtimes for any host. Medium Tue, 18 Apr 2023 11:09:09 GMT https://vulnogram.org/CVE-2023-1768 https://vulnogram.org/CVE-2023-1768 Inappropriate error handling in Tribe29 Checkmk <= 2.1.0p25, <= 2.0.0p34, <= 2.2.0b3 (beta), and all versions of Checkmk 1.6.0 causes the symmetric encryption of agent data to fail silently and transmit the data in plaintext in certain configurations… Low Tue, 04 Apr 2023 06:30:29 GMT https://vulnogram.org/CVE-2023-22288 https://vulnogram.org/CVE-2023-22288 HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject malicious HTML into Emails Medium Mon, 20 Mar 2023 15:33:59 GMT https://vulnogram.org/CVE-2022-48320 https://vulnogram.org/CVE-2022-48320 Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new visual elements to multiple pages. Medium Mon, 20 Feb 2023 16:56:40 GMT https://vulnogram.org/CVE-2022-48319 https://vulnogram.org/CVE-2022-48319 Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to gain access to the host secret through the unprotected agent updater log… Medium Mon, 20 Feb 2023 16:56:18 GMT https://vulnogram.org/CVE-2022-48318 https://vulnogram.org/CVE-2022-48318 No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information disclosure through automatically generated user specific tags within Rest API documentation. Medium Mon, 20 Feb 2023 16:55:53 GMT https://vulnogram.org/CVE-2022-48317 https://vulnogram.org/CVE-2022-48317 Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI. Medium Mon, 20 Feb 2023 16:55:28 GMT https://vulnogram.org/CVE-2022-48321 https://vulnogram.org/CVE-2022-48321 Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted endpoints by use of the host registration API. Medium Mon, 20 Feb 2023 16:54:44 GMT https://vulnogram.org/CVE-2022-47909 https://vulnogram.org/CVE-2022-47909 Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from loc… Medium Mon, 20 Feb 2023 16:53:37 GMT https://vulnogram.org/CVE-2022-46836 https://vulnogram.org/CVE-2022-46836 PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component. Critical Mon, 20 Feb 2023 16:52:56 GMT https://vulnogram.org/CVE-2022-46303 https://vulnogram.org/CVE-2022-46303 Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary command… High Mon, 20 Feb 2023 16:49:49 GMT https://vulnogram.org/CVE-2022-43440 https://vulnogram.org/CVE-2022-43440 Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable High Thu, 09 Feb 2023 08:30:42 GMT https://vulnogram.org/CVE-2023-0284 https://vulnogram.org/CVE-2023-0284 Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected. Medium Tue, 24 Jan 2023 12:03:57 GMT https://vulnogram.org/CVE-2022-4884 https://vulnogram.org/CVE-2022-4884 Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file. Low Mon, 09 Jan 2023 16:11:16 GMT