mongodb vulnerabilities and exploits

(subscribe to this query)

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version before 5.0.31, MongoDB Server v6.0 version before 6.0.20, MongoDB Server v7...

Mongodb Mongodb 5.0.0 Mongodb Mongodb 5.0.1 Mongodb Mongodb 5.0.2 Mongodb Mongodb 5.0.3 Mongodb Mongodb 5.0.4 Mongodb Mongodb 5.0.5 Mongodb Mongodb 5.0.6 Mongodb Mongodb 5.0.7 Mongodb Mongodb 5.0.8 Mongodb Mongodb 5.0.9 Mongodb Mongodb 5.0.10 Mongodb Mongodb 5.0.11

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions before 5.0.31, MongoDB v6.0 versions before 6.0.20 and MongoDB v7.0 versions...

Mongodb Mongodb 5.0.0 Mongodb Mongodb 5.0.1 Mongodb Mongodb 5.0.2 Mongodb Mongodb 5.0.3 Mongodb Mongodb 5.0.4 Mongodb Mongodb 5.0.5 Mongodb Mongodb 5.0.6 Mongodb Mongodb 5.0.7 Mongodb Mongodb 5.0.8 Mongodb Mongodb 5.0.9 Mongodb Mongodb 5.0.10 Mongodb Mongodb 5.0.11

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 before 5.0.31, MongoDB Server v6.0 before 6.0.20, MongoDB Server v7.0 before 7.0.16 and Mo...

Mongodb Mongodb 5.0.0 Mongodb Mongodb 5.0.1 Mongodb Mongodb 5.0.2 Mongodb Mongodb 5.0.3 Mongodb Mongodb 5.0.4 Mongodb Mongodb 5.0.5 Mongodb Mongodb 5.0.6 Mongodb Mongodb 5.0.7 Mongodb Mongodb 5.0.8 Mongodb Mongodb 5.0.9 Mongodb Mongodb 5.0.10 Mongodb Mongodb 5.0.11

The default configuration for MongoDB prior to 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.

Mongodb Mongodb Mongodb Mongodb 1.2.0 Mongodb Mongodb 1.4.0 Mongodb Mongodb 1.6.0 Mongodb Mongodb 1.8.0 Mongodb Mongodb 2.0.0 Mongodb Mongodb 2.0.1 Mongodb Mongodb 2.0.2 Mongodb Mongodb 2.0.3 Mongodb Mongodb 2.0.4 Mongodb Mongodb 2.0.5 Mongodb Mongodb 2.0.6

MongoDB prior to 2.0.9 and 2.2.x prior to 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted ...

Mongodb Mongodb Mongodb Mongodb 1.2.0 Mongodb Mongodb 1.4.0 Mongodb Mongodb 1.6.0 Mongodb Mongodb 1.8.0 Mongodb Mongodb 2.0.0 Mongodb Mongodb 2.0.1 Mongodb Mongodb 2.0.2 Mongodb Mongodb 2.0.3 Mongodb Mongodb 2.0.4 Mongodb Mongodb 2.0.5 Mongodb Mongodb 2.0.6

2 EDB exploits

MongoDB prior to 2.4.13 and 2.6.x prior to 2.6.8 allows remote malicious users to cause a denial of service via a crafted UTF-8 string in a BSON request.

Fedoraproject Fedora 21 Mongodb Mongodb Mongodb Mongodb 2.6.0 Mongodb Mongodb 2.6.1 Mongodb Mongodb 2.6.2 Mongodb Mongodb 2.6.3 Mongodb Mongodb 2.6.4 Mongodb Mongodb 2.6.5 Mongodb Mongodb 2.6.6 Mongodb Mongodb 2.6.7

MongoDB 2.4.x prior to 2.4.5 and 2.5.x prior to 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.

Mongodb Mongodb 2.4.0 Mongodb Mongodb 2.4.1 Mongodb Mongodb 2.4.2 Mongodb Mongodb 2.4.3 Mongodb Mongodb 2.4.4 Mongodb Mongodb 2.5.0

The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 up to and including 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.

Mongodb Mongodb 2.4.0 Mongodb Mongodb 2.4.1 Mongodb Mongodb 2.4.2 Mongodb Mongodb 2.4.3 Mongodb Mongodb 2.4.4

1 EDB exploit

The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible appli...

Mongodb Libbson 0.2.0 Mongodb Libbson 0.2.2 Mongodb Libbson 0.2.4 Mongodb Libbson 0.4.0 Mongodb Libbson 0.5.0 Mongodb Libbson 0.6.0 Mongodb Libbson 0.6.2 Mongodb Libbson 0.6.4 Mongodb Libbson 0.6.6 Mongodb Libbson 0.6.8 Mongodb Libbson 0.8.0 Mongodb Libbson 0.8.2

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using &lsq...

Mongodb Mongosh 0.2.2 Mongodb Mongosh 0.3.1 Mongodb Mongosh 0.4.0 Mongodb Mongosh 0.4.2 Mongodb Mongosh 0.5.0 Mongodb Mongosh 0.5.2 Mongodb Mongosh 0.6.1 Mongodb Mongosh 0.7.7 Mongodb Mongosh 0.8.0 Mongodb Mongosh 0.8.1 Mongodb Mongosh 0.8.2 Mongodb Mongosh 0.9.0

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook