Malware in portfolio-config-manager-mongo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4692 Malicious code in portfolio-config-manager-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7313dd72cd35e9b2cc754bd7b41842071deb31b3be1bef658e61241e6bca17e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32229

A information disclosure vulnerability exists in Rockert.Chat...

CVE-2021-21422

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, howev...

CVE-2020-24391

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

Debian: Security Advisory (DLA-4175-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-4175-1 mongo-c-driver - security update

Bulletin has no description...

Malicious code in mongo-errorlog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e32915bf4c99db1cb294f47f98fa059abf22bbbb6729673f93f8370a0b9882e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mongo-errorlog

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3580 Malicious code in mongo-errorlog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e32915bf4c99db1cb294f47f98fa059abf22bbbb6729673f93f8370a0b9882e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-AIRFLOW-2024-25141

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: falcosidekick, sftpgo-plugin-kms, grafana-alloy, grafana-agent-operator, prometheus, jitsucom-bulker, xeol, buildkitd, dgraph, step-ca, kubescape, gitness, k8sgpt, gitsign, flux-image-reflector-controller, flux-image-automation-controller, kots,...

Apache NiFi 安全漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A security vulnerability exists in Apache NiFi versions 1.13.0 through 2.2.0, which stems from the possibility that...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, direnv, delve, src-fingerprint, grpcurl, grafana-operator, nri-haproxy, wireguard-go, fq, cni-plugins, controller-gen, flannel-cni-plugin, golangci-lint, caddy, kyverno-policy-reporter-kyverno-plugin, bazelisk, nri-mongodb, kustomize,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, direnv, delve, src-fingerprint, grpcurl, grafana-operator, nri-haproxy, wireguard-go, fq, cni-plugins, controller-gen, flannel-cni-plugin, golangci-lint, caddy, kyverno-policy-reporter-kyverno-plugin, bazelisk, nri-mongodb, kustomize,...

CVE-2024-25141

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-8013

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryp...

PT-2024-38752

Name of the Vulnerable Software and Affected Versions: mongocryptd versions prior to 5.0.29 mongocryptd versions prior to 6.0.17 mongocryptd versions prior to 7.0.12 mongocryptd versions prior to 7.3.4 mongo crypt v1.so shared libraries versions prior to 6.0.17 mongo crypt v1.so shared libraries...

mongo-go-driver:fuzz_decode: Crash in fuzz_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5157460095074304 Project: mongo-go-driver Fuzzing Engine: libFuzzer Fuzz Target: fuzzdecode Job Type: libfuzzerasanmongo-go-driver Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: fuzzdecode Sanitizer:...