CVE-2024-6572

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' in Checkmk before Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48 and 2.0.0 (EOL) allows man-in-the-middle attackers to intercept traffic

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-322

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-65735.3The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plu CVE-2024-65745.3The Laposta plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.12. This is due to the plugin CVE-2024-65755.4The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to CVE-2024-65769.8Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit T CVE-2024-65776.3In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ens CVE-2024-65785.4A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutrali CVE-2024-65794.3The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a CVE-2024-65806.5The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading CVE-2024-65819.0A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due CVE-2024-65824.3A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organizati CVE-2024-65834.3A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to ar CVE-2024-65849.1The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.