512 matches found
Design/Logic Flaw
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...
CVE-2020-24391
Summary: CVE-2020-24391 affects Mongo-Express before 1.0.0 and enables remote code execution. The Nuclei template describes that it uses unsafe evaluation (safer-eval) to validate user-supplied JavaScript, and that the sandboxing can be bypassed, allowing code execution in the node server context...
CVE-2020-24391
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...
CVE-2020-24391
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...
CVE-2020-24391: Undefined Security Weakness
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...
PT-2021-11028
Name of the Vulnerable Software and Affected Versions: mongo-express versions prior to 1.0.0 Description: The issue concerns the unsafe implementation of certain advanced syntax support in mongo-express. Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the...
mongo-express 安全漏洞
mongo-express is a lightweight, web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express before 1.0.0, which stems from implementing support for certain advanced syntax in an insecure manner...
sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2021-23372 via mongo-express (1.0.0-alpha.1)
mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2021-23372 Source advisory: SNYK:JS-MONGOEXPRESS-1085403...
Denial of Service (DoS)
Overview mongo-express is a web-based MongoDB admin interface written with Node.js, Express and Bootstrap3 Affected versions of this package are vulnerable to Denial of Service DoS when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. Details Denial of...
Mquery Security Vulnerability
Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...
VulnCheck KEV: CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method...
2.5 bug fix update
An update is available for rubygem-bson, rubygem-mysql2, rubygem-bundler, ruby, rubygem-mongo, rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
CVE-2020-7922
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...
PT-2020-12649
Name of the Vulnerable Software and Affected Versions Firmware Analysis and Comparison Tool FACT version 3 Description The issue is related to Stored XSS when updating analysis details via a localhost web request. This is caused by the mishandling of the tags and version fields in the...
CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
Design/Logic Flaw
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
CVE-2014-0234
Technical details for CVE-2014-0234 are not publicly available in the provided documents. No affected product/version/impact is specified here. Monitor for updates in the connected sources for exact remediation guidance.
The vulnerability of the web interface of the Mongo-express database management system for MongoDB allows a hacker to execute arbitrary code on the target system by sending a specially crafted request.
The vulnerability in the web interface of the Mongo-express database management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system by sending a specially crafted request...
