14 matches found
CVE-2026-18704
creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:43+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813 2026-08-15 14:00:38+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mt4tidhjus2x 2026-08-15 14:00:52+00:00| seen|...
CVE-2026-18704
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
CVE-2026-18704
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
CVE-2026-18704
Summary: CVE-2026-18704 affects MongoDB Server's aggregation framework. Affected component is an internal-use aggregation stage that is reachable by external clients without proper authorization checks on its embedded operations. This could allow an authenticated user with only read privileges to...
CVE-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...
CVE-2017-18704
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.32, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 befo...
CVE-2020-18704
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
CVE-2020-18704
CVE-2020-18704 affects Django-Widgy v0.8.4 . The issue is an unrestricted upload of a file with a dangerous type via the image widget in the component “Change Widgy Page” , which can allow remote attackers to execute arbitrary code. The provided documents do not include specific exploitation deta...
CVE-2017-18704
creationtimestamp| type| source ---|---|--- 2020-04-24 19:37:05+00:00| seen| https://t.me/cibsecurity/11640...
CVE-2017-18704
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.32, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 befo...
CVE-2017-18704
CVE-2017-18704 describes an information-disclosure vulnerability in various NETGEAR devices where an attacker can read arbitrary files. Affected models and firmware ranges include D6220 (< 1.0.0.32), D6400 (< 1.0.0.60), D8500 (< 1.0.3.29), R6250 (< 1.0.4.16), R6300v2 (< 1.0.4.18), ...
CVE-2019-18704
CVE-2019-18704 entry is rejected/not used and does not represent an active vulnerability entry.
CVE-2018-18704
The CVE-2018-18704 entry: PhpTpoint Pharmacy Management System contains a SQL injection in the index.php username parameter. According to CNVD-2019-23084, this can be exploited by a remote attacker to bypass the login page and authenticate as admin or another user. NVD data indicates a high to cr...