MAL-2025-3580 Malicious code in mongo-errorlog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e32915bf4c99db1cb294f47f98fa059abf22bbbb6729673f93f8370a0b9882e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongo-errorlog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e32915bf4c99db1cb294f47f98fa059abf22bbbb6729673f93f8370a0b9882e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0 <=0.120.0), ai.ancf.lmos:arc-memory-mongo-spring-boot-starter (>=0.114.0 <=0.120.0) +7782 more potentially affected by CVE-2025-22235 via org.springframework.boot:spring-boot (>=3.4.0 <=3.4.4)

org.springframework.boot:spring-boot MAVEN version =3.4.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.0, =1.0.0, =1.0.28 and more Source cves: CVE-2025-22235 Source advisory: OSV:GHSA-RC42-6C7J-7H5R...

BIT-AIRFLOW-2024-25141

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: scorecard, flux-kustomize-controller, step-ca, step, external-dns, flux, guac, crossplane-provider-family-azure, pulumi, opentelemetry-collector, crossplane, restic, kine, vexctl, gitea, k8sgpt, openbao, goreleaser, grafana-mimir, crossplane-provider-azure-storage,...

Apache NiFi 安全漏洞

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation, and system brokering logic. A security vulnerability exists in Apache NiFi versions 1.13.0 through 2.2.0, which stems from the possibility that...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, scorecard, memcached-exporter, kubernetes-csi-external-resizer, bom, docker-credential-acr-env, lazygit, fq, paranoia, flux, slsa-verifier, newrelic-infrastructure-agent, nri-prometheus, kube-logging-operator, logstash-exporter, pulumi,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, scorecard, memcached-exporter, kubernetes-csi-external-resizer, bom, docker-credential-acr-env, lazygit, fq, paranoia, flux, slsa-verifier, newrelic-infrastructure-agent, nri-prometheus, kube-logging-operator, logstash-exporter, pulumi,...

CVE-2024-25141

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-8013

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryp...

CVE-2024-20489

A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials. This vulnerability is due to improper storage of the unencrypted database credentials on the device that is running...

PT-2024-7097 · Cisco · Cisco Routed Pon Controller +1

Name of the Vulnerable Software and Affected Versions: Cisco Routed PON Controller Software affected versions not specified Description: The issue exists due to insufficient validation of arguments passed to specific configuration commands, allowing an authenticated, remote attacker with...

openSUSE Security Advisory (SUSE-SU-2024:1865-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2024-6384

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versio...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element due to incorrect validation of files loaded from a local untrusted directory on Windows systems. An attacker can exploit this by placing crafted files in the untrusted directory, causing the application ...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-673)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-673 advisory. Memory handling issue in editcap could cause denial of service via crafted capture file CVE-2024-4853 MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14,...

OESA-2024-1880 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: The bsonstringappend function in MongoDB C Driver may be vulnerab...

ruby security update

ruby 2.5.9-112 - Fix ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755. CVE-2023-36617 Resolves: RHEL-5614 - Fix Buffer overread vulnerability in StringIO. CVE-2024-27280 Resolves: RHEL-34125 - Fix RCE vulnerability with .rdocoptions in RDoc. CVE-2024-27281 Resolves: RHEL-34117 -...

SUSE-SU-2024:2265-1 Security update for wireshark

This update for wireshark fixes the following issues: Update to version 3.6.22: - CVE-2024-4854: MONGO and ZigBee TLV dissector infinite loops bsc1224274 - CVE-2024-4853: The editcap command line utility could crash when chopping bytes from the beginning of a packet bsc1224259 - CVE-2024-4855: Th...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper certificate validation. An attacker can intercept secure communications by presenting a forged certificate. Remediation Upgrade github.com/mongodb/mongo-tools/mongoexport to version 3.6.21...