Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mongodb mongodb - vulnerabilities and exploits

(subscribe to this query)
6.4
CVSSv2
CVE-2012-6619
The default configuration for MongoDB prior to 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.
Mongodb Mongodb 2.2.2Mongodb Mongodb 2.2.1Mongodb Mongodb 2.0.3Mongodb Mongodb 2.0.2Mongodb Mongodb 2.2.4Mongodb Mongodb 2.2.5Mongodb Mongodb 2.2.0Mongodb Mongodb 2.0.8Mongodb Mongodb 2.0.1Mongodb Mongodb 2.0.0Mongodb Mongodb 2.2.6Mongodb Mongodb 2.2.7Mongodb Mongodb 2.3.0Mongodb Mongodb 2.2.3Mongodb Mongodb 2.0.5Mongodb Mongodb 2.0.4Mongodb Mongodb 1.4.0Mongodb Mongodb 1.2.0Mongodb Mongodb 2.0.7Mongodb Mongodb 2.0.6Mongodb Mongodb 1.8.0Mongodb Mongodb 1.6.0
6
CVSSv2
CVE-2013-1892
MongoDB prior to 2.0.9 and 2.2.x prior to 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted ...
Mongodb Mongodb 1.8.0Mongodb Mongodb 2.0.0Mongodb Mongodb 2.0.6Mongodb Mongodb 2.2.2Mongodb Mongodb 1.2.0Mongodb Mongodb 2.2.1Mongodb Mongodb 2.2.0Mongodb Mongodb 1.4.0Mongodb Mongodb 2.0.1Mongodb Mongodb 2.0.3Mongodb MongodbMongodb Mongodb 2.0.4Mongodb Mongodb 2.2.3Mongodb Mongodb 2.0.5Mongodb Mongodb 1.6.0Mongodb Mongodb 2.0.2Mongodb Mongodb 2.0.7Redhat Enterprise Mrg 2.3
5
CVSSv2
CVE-2015-1609
MongoDB prior to 2.4.13 and 2.6.x prior to 2.6.8 allows remote malicious users to cause a denial of service via a crafted UTF-8 string in a BSON request.
Fedoraproject Fedora 21Mongodb Mongodb 2.6.2Mongodb Mongodb 2.6.3Mongodb Mongodb 2.6.4Mongodb Mongodb 2.6.5Mongodb Mongodb 2.6.6Mongodb MongodbMongodb Mongodb 2.6.7Mongodb Mongodb 2.6.0Mongodb Mongodb 2.6.1
6.5
CVSSv2
CVE-2013-4650
MongoDB 2.4.x prior to 2.4.5 and 2.5.x prior to 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
Mongodb Mongodb 2.4.0Mongodb Mongodb 2.4.1Mongodb Mongodb 2.4.2Mongodb Mongodb 2.4.3Mongodb Mongodb 2.5.0Mongodb Mongodb 2.4.4
6.5
CVSSv2
CVE-2013-3969
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 up to and including 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
Mongodb Mongodb 2.4.0Mongodb Mongodb 2.4.1Mongodb Mongodb 2.4.2Mongodb Mongodb 2.4.3Mongodb Mongodb 2.4.4
5
CVSSv2
CVE-2020-7925
Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated malicious user to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions before 4.4.0-rc12; MongoD...
Mongodb MongodbMongodb Mongodb 4.4.0
5
CVSSv2
CVE-2014-3971
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x prior to 2.6.2 allows remote malicious users to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.
Mongodb Mongodb 2.6.1Mongodb Mongodb 2.6.0
5
CVSSv2
CVE-2016-3104
mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote malicious users to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database.
Mongodb Mongodb 2.6.0Mongodb Mongodb 2.4.0
4
CVSSv2
CVE-2020-7922
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.50...
Mongodb Mongodb Enterprise Kubernetes Operator 1.1Mongodb Mongodb Enterprise Kubernetes OperatorMongodb Mongodb Enterprise Kubernetes Operator 1.0
NA
CVE-2021-32050
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an...
Mongodb C\\+\\+Mongodb Node.jsMongodb Swift DriverMongodb Php DriverMongodb C Driver
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48654CVE-2024-2757authentication bypassCVE-2024-3194CVE-2024-33640CVE-2024-21111dosinsecure direct object referenceCVE-2024-21345
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook