838 matches found
PT-2021-11028
Name of the Vulnerable Software and Affected Versions: mongo-express versions prior to 1.0.0 Description: The issue concerns the unsafe implementation of certain advanced syntax support in mongo-express. Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the...
sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2021-23372 via mongo-express (1.0.0-alpha.1)
mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2021-23372 Source advisory: SNYK:JS-MONGOEXPRESS-1085403...
Denial of Service (DoS)
Overview mongo-express is a web-based MongoDB admin interface written with Node.js, Express and Bootstrap3 Affected versions of this package are vulnerable to Denial of Service DoS when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. Details Denial of...
ch.software-atelier:simpleflex-auth (>=2.1.1, <=2.2.4), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +227 more potentially affected by CVE-2021-20328 via org.mongodb:mongo-java-driver (>=3.11.0, <=3.11.2)
org.mongodb:mongo-java-driver MAVEN version =3.11.0, =2.1.1, =0.1.28, =0.1.0, =1.0.0-rc1, =5.7.9, =5.7.9, =5.7.9, =5.7.9, =5.7.9, =5.1.8, =5.1.8, =5.6.2, =5.6.4 and more Source cves: CVE-2021-20328 Source advisory: MEND:CVE-2021-20328...
ai.tripl:arc-mongodb-pipeline-plugin_2.12 (>=1.3.0, <=1.4.0), be.personify.iam:personify-scim-server (>=1.1.5.release, <=1.2.5.release) +346 more potentially affected by CVE-2021-20328 via org.mongodb:mongo-java-driver (>=3.12.0, <=3.12.7)
org.mongodb:mongo-java-driver MAVEN version =3.12.0, =1.3.0, =1.1.5.release, =1.3.0, =1.3.0, =1.2.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =3.13.0, =3.13.0, =3.15.3, =3.16.3 - ch.exense.step:step-controller-plugins-measurements-jdbc 3.15.3 - ch.exense.step:step-controller-plugins-measurements-log 3.15....
ai.hyacinth.framework:core-service-discovery-server (>=0.5.0, <=0.5.24), ai.lum:odinson-rest-api_2.12 (>=0.3.1, <=0.5.0) +4009 more potentially affected by CVE-2020-28491 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.8.0.rc1, <=2.11.3)
com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.8.0.rc1, =0.5.0, =0.3.1, =j8.2.2.0, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =0.1.2, =0.1.2, =0.2.5 and more Source cves: CVE-2020-28491 Source advisory: MEND:CVE-2020-2849...
Mquery Security Vulnerability
Aheckmann Mquery is a Javascript-based codebase for efficiently generating Mongdb query statements from the individual developer Aheckmann. A security vulnerability exists in mquery lib/utils.js versions prior to 3.2.3, which allows contamination attacks because a special attribute e.g. proto can...
mongo-rest-api (0.1.0), pine-ql (>=0.1.0, <=0.5.4) potentially affected by CVE-2020-28272 via keyget (1.0.1)
keyget NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on keyget and may be impacted: - mongo-rest-api 0.1.0 - pine-ql =0.1.0, =0.5.4 Source cves: CVE-2020-28272 Source advisory: MEND:CVE-2020-28272...
VulnCheck KEV: CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method...
ruby:2.5 bug fix update
An update is available for rubygem-bson, rubygem-mysql2, rubygem-bundler, ruby, rubygem-mongo, rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
3a-server (>=0.7.41, <=0.9.10), 3a-server-mongo (>=0.1.0-beta.1, <=1.0.0-beta.1) +11 more potentially affected by unknown CVE via html-pdf-chrome (>=0.2.0, <=0.5.0)
html-pdf-chrome NPM version =0.2.0, =0.7.41, =0.1.0-beta.1, =0.1.3, =0.2.0, =1.0.0, =1.1.0, =1.0.0, =0.1.0, =1.0.3, =0.0.0, =0.5.12 Source cves: unknown CVE Source advisory: GHSA-5P98-WPC9-G498...
io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2019-14820 via org.keycloak:keycloak-core (1.1.0.beta2)
org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...
CVE-2020-7922
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...
PT-2020-12649
Name of the Vulnerable Software and Affected Versions Firmware Analysis and Comparison Tool FACT version 3 Description The issue is related to Stored XSS when updating analysis details via a localhost web request. This is caused by the mishandling of the tags and version fields in the...
CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
Design/Logic Flaw
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this m...
CVE-2014-0234
Technical details for CVE-2014-0234 are not publicly available in the provided documents. No affected product/version/impact is specified here. Monitor for updates in the connected sources for exact remediation guidance.
Mongo-express Code Execution
The vulnerability in the web interface of the Mongo-express database management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the target system by sending a specially crafted request...
