Tribe29 vulnerabilities
We track 9 vulnerabilities in Tribe29 products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on March 22, 2024.
Latest Tribe29 vulnerabilities
- 7.8 High severity
Checkmk: Least Privilege Violation
Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0b4 (beta), 2.2.0p24, 2.1.0p41 and 2.0.0 (EOL) allows local users to escalate privileges.
- 8.8 High severity
Checkmk: Inclusion of Functionality from Untrusted Control Sphere
Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe29's Checkmk <= 2.1.0p6, Checkmk <= 2.0.0p27, and all versions of Checkmk 1.6.0 (EOL) allowing an att
- 8.8 High severity
Checkmk Appliance: Incorrect Permission Assignment for Critical Resource
Privilege escalation in Tribe29 Checkmk Appliance before 1.6.4 allows authenticated site users to escalate privileges via incorrectly set permissions.
- 9.8 Critical severity
Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10…
Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired session tokens when communicating with the RestAPI.
- 7.8 High severity
Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's…
Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.
- 8.8 High severity
Checkmk: Improper Control of Generation of Code
PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.
- 7.5 High severity
Checkmk: Improper Neutralization of Special Elements used in an OS Command
Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management permissions, as well as LDAP administrators in certain scenarios, to perform arbitrary commands within t
- 7.8 High severity
Checkmk: Uncontrolled Search Path Element
Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site user to escalate privileges via a manipulated unixcat executable
- 8.1 High severity
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can…
Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.