CVE-2022-32229

CVE-2022-32229 affects Rocket.Chat prior to 5.x, caused by lack of sanitization in the /api/v1/chat.getThreadsList endpoint. This MongoDB injection flaw can disclose private thread messages to unauthorized users, as demonstrated by the HackerOne report and multiple CVE references. The issue impac...

Rocket.Chat information leakage vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an information disclosure vulnerability that stems from the actionLinkHandler method allowing message ID enumeration using a Regex MongoDB query. An attacker can exploit the vulnerability to obtain sensitive information...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-5038c3236c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

Springcve-2022-22980 spring data mongodb remote code executio...

CVE-2022-31551

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31551

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31551

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path traversal

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31551: Improper Limitation of a Pathname to a Restricted Directory

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

flask-mongo-skel path traversal vulnerability

flask-mongo-skel is a Flask MongoDB framework from Shamail Tayyab's personal developer. flask-mongo-skel 2012-11-01 and earlier versions contain a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter resource or file paths for The vulnerability is...

PT-2022-20823

Name of the Vulnerable Software and Affected Versions pleomax00/flask-mongo-skel versions through 2012-11-01 Description The issue allows absolute path traversal due to the unsafe use of the Flask send file function. This enables potential access to sensitive files outside the intended directory...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

org.bitbucket.swattu:datastore-utils (>=4.0.32, <=4.0.63), org.bitbucket.swattu:lock-utils (>=4.0.32, <=4.0.63) +4 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.10.13.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.bitbucket.swattu:datastore-utils =4.0.32, =4.0.32,...

io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.7.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...

com.eworkcloud:ework-cloud-starter-mongo (>=1.5.6, <=1.8.6), org.springframework.boot:spring-boot-starter-data-mongodb (1.5.20.release) +1 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.10.20.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.eworkcloud:ework-cloud-starter-mongo =1.5.6, =1.8.6 -...

com.github.jknack:mwa-mongo (>=0.4.1, <=0.4.2), com.github.jknack:mwa-morphia (>=0.4.1, <=0.4.2) +7 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.3.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.jknack:mwa-mongo =0.4.1, =0.4.1, =4.1.0, =3.0.6,...

com.github.jknack:mwa-mongo (0.4.0), com.github.jknack:mwa-morphia (0.4.0) +1 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.2.3.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.jknack:mwa-mongo 0.4.0 - com.github.jknack:mwa-morph...

com.gitee.zodiacstack:zodiac-mongo (>=1.2.11, <=1.6.8), com.gitee.zodiacstack:zodiac-mongo-spring-boot-starter (>=1.2.11, <=1.6.8) +14 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.2.12.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.gitee.zodiacstack:zodiac-mongo =1.2.11, =1.2.11,...

org.inigma.shared:inigma-mongo (>=0.6.1, <=0.10.0), org.springframework.data:spring-data-mongodb-cross-store (1.1.2.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.1.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.inigma.shared:inigma-mongo =0.6.1, =0.10.0 -...