Vulnerabilities in Checkmk GmbH

91 results
Vexday analysis

Com 81 CVEs catalogadas e nenhuma atualmente em exploração ativa confirmada pelo CISA KEV, o perfil de risco do Checkmk GmbH situa-se abaixo da média geral do catálogo em termos de exploração ativa. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que indica atenção insuficiente a controles de saída e validação de entrada nas interfaces da solução. A CVE mais perigosa no momento, CVE-2023-31209, apresenta EPSS de 0,0102, sugerindo baixa probabilidade de exploração em curto prazo, embora o surgimento de 14 novas vulnerabilidades nos últimos 90 dias indique um ritmo de descoberta que merece monitoramento contínuo. As 2 CVEs de severidade crítica e a ausência de PoCs públicas conhecidas atualmente reduzem a superfície de risco imediato, mas não eliminam a necessidade de ciclos regulares de patching.

CVE-2023-23548MEDIUMXSS in business intelligenceEPSS 0.4%CVE-2024-28833MEDIUMMissing brute-force protection for two factor authenticationEPSS 0.4%CVE-2024-6052MEDIUMXSS in SQL check parametersEPSS 0.4%CVE-2024-6747MEDIUMInformation leak in mknotifydEPSS 0.4%CVE-2026-92882LOWRedact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesEPSS 0.4%CVE-2024-2380MEDIUMXSS in graph renderingEPSS 0.3%CVE-2024-28831MEDIUMXSS in confirmation pop-upEPSS 0.3%CVE-2024-6572MEDIUMImproper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'EPSS 0.3%CVE-2024-28830LOWAutomation user secrets written to audit logEPSS 0.3%CVE-2024-28832MEDIUMXSS in Crash Report PageEPSS 0.3%CVE-2025-32918MEDIUMLivestatus injection in autocomplete endpointEPSS 0.3%CVE-2025-64998HIGHSession hijacking via exposed session signing secret in distributed Checkmk setupsEPSS 0.3%CVE-2024-0670HIGHPrivilege escalation in windows agentEPSS 0.3%CVE-2024-38858LOWCross-site scripting in Robotmk logs viewEPSS 0.3%CVE-2024-38860MEDIUMReflected links in error message facilitate phishing attacksEPSS 0.3%CVE-2024-38862MEDIUMSNMP and IMPI secrets written to audit logEPSS 0.3%CVE-2025-1075MEDIUMLDAP credentials logged to Apache error logEPSS 0.3%CVE-2024-3367MEDIUMArgument injection to runmqscEPSS 0.3%CVE-2025-3506MEDIUMPotentially senitive path exposed via unauthenticated http routeEPSS 0.3%CVE-2025-32917MEDIUMPrivilege escalation in jar_signatureEPSS 0.3%