CVE-2019-19729

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

Input validation

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

CVE-2019-19729

CVE-2019-19729 affects the BSON ObjectID package for Node.js (v1.3.0). The issue arises when ObjectID() accepts user input with an extra property, causing the module to return early if it detects _bsontype==ObjectID, which can allow objects in arbitrary forms to bypass formatting if they include ...

CVE-2019-19729

An issue was discovered in the BSON ObjectID aka bson-objectid package 1.3.0 for Node.js. ObjectID allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects bsontype==ObjectID in the user-input...

UBUNTU-CVE-2019-11484

Kevin Backhouse discovered an integer overflow in bsonensurespace, as used in whoopsie...

PT-2019-4760 · Canonical · Whoopsie +1

Name of the Vulnerable Software and Affected Versions: whoopsie affected versions not specified Description: The issue is caused by an integer overflow in the bson ensure space function used in the whoopsie error registration service of the Ubuntu operating system. This can potentially allow an...

Improper Input Validation in Automattic Mongoose

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

CVE-2019-17426

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

Improper access control

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

CVE-2019-17426

Automattic Mongoose up to version 5.7.4 is affected. The root cause is that a query object containing a _bsontype attribute is ignored, which can bypass access control in some applications (e.g., a query filter interference with _bsontype). The CVE covers this behavior in older versions of the bs...

[SECURITY] Fedora 28 Update: libbson-1.9.5-3.fc28

This is a library providing useful routines related to building, parsing, and iterating BSON documents...

[SECURITY] Fedora 27 Update: libbson-1.9.5-3.fc27

This is a library providing useful routines related to building, parsing, and iterating BSON documents...

@abtnode/mongoose-nedb (1.0.16), @alma/widgets (>=4.0.0, <=4.4.1) +272 more potentially affected by CVE-2018-13863 via bson (>=0.5.2, <=1.0.4)

bson NPM version =0.5.2, =4.0.0, =0.2.4, =0.2.4, =0.0.0, =0.4.1, =0.3.0, =0.2.0, =0.3.0, =0.3.0, =0.2.0, =0.0.1, =1.6.3-ml, =0.3.0, =0.0.1, =0.0.3 and more Source cves: CVE-2018-13863 Source advisory: OSV:GHSA-8462-Q7X7-G2X4...

GHSA-8462-Q7X7-G2X4 js-bson vulnerable to REDoS

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

CVE-2018-16790

bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...

Heap overflow

bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...

UBUNTU-CVE-2018-16790

bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...

CVE-2018-16790

CVE-2018-16790 affects libbson 1.12.0 (used by MongoDB’s libbson and the mongo-c-driver). The vulnerability is a heap-based buffer over-read triggered by a crafted BSON buffer in bson_iter_next_internal, as described for libbson 1.12.0. This can impact applications that consume BSON via the affec...

PT-2018-13750 · Mongodb +3 · Libbson +3

Name of the Vulnerable Software and Affected Versions: libbson version 1.12.0 Description: The issue is related to a heap-based buffer over-read in the bson iter next internal function in bson-iter.c via a crafted bson buffer. Recommendations: For libbson version 1.12.0, at the moment, there is n...

CVE-2018-13863

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...