Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
mongodb mongodb vulnerabilities and exploits
(subscribe to this query)
3.5
CVSSv2
CVE-2020-7921
Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects MongoDB Server v4.2 ...
Mongodb Mongodb
4.3
CVSSv2
CVE-2020-12135
bson prior to 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
Whoopsie Project Whoopsie
Mongodb C Driver
1 Github repository
4
CVSSv2
CVE-2020-7922
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.50...
Mongodb Mongodb Enterprise Kubernetes Operator 1.1
Mongodb Mongodb Enterprise Kubernetes Operator
Mongodb Mongodb Enterprise Kubernetes Operator 1.0
5.5
CVSSv2
CVE-2019-2391
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.
Mongodb Js-bson
1 Github repository
7.5
CVSSv2
CVE-2020-7610
All versions of bson prior to 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Mongodb Bson
5
CVSSv2
CVE-2015-4411
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby prior to 3.0.4 as used in rubygem-moped allows remote malicious users to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Mongodb Bson
Fedoraproject Fedora 22
Fedoraproject Fedora 21
5
CVSSv2
CVE-2013-1895
The py-bcrypt module prior to 0.3 for Python does not properly handle concurrent memory access, which allows malicious users to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Python Py-bcrypt
Fedoraproject Fedora 17
Fedoraproject Fedora 18
1 Github repository
5
CVSSv2
CVE-2020-1929
The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally whi...
Apache Beam
7.5
CVSSv2
CVE-2013-0165
cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.
Redhat Openshift -
6.4
CVSSv2
CVE-2019-17426
Automattic Mongoose up to and including 5.7.4 allows malicious users to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter...
Mongoosejs Mongoose
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
logic flaw
CVE-2024-23692
CVE-2024-26229
CVE-2024-35255
CVE-2024-5835
CVE-2024-5837
XML external entity
dos
CVE-2024-5813
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
3
4
5
6
7
8
9
10
NEXT »