BIT-MONGODB-2025-6707 Race condition in privilege cache invalidation cycle

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior ...

CVE-2025-10491

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2025-10491

The CVE-2025-10491 issue concerns MongoDB Server on Windows where the MSI installer may leave ACLs unset on custom installation directories, enabling a local attacker to insert a malicious DLL and hijack the MongoDB process. Affected versions are MongoDB Server 6.0 prior to 6.0.25, 7.0 prior to 7...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server v6.0 versions prior to 6.0.25, v7.0 versions...

zscan

This is a collection of tools for scanning and blasting exploiting services on a network. The tool is called Zscan and is written in Go. It has several modules for different types of scans and exploits, including: Port scanning Service blasting exploiting FTP blasting HTTP blasting LDAP blasting...

Linux Distros Unpatched Vulnerability : CVE-2024-10921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct...

Linux Distros Unpatched Vulnerability : CVE-2025-3084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. Thi...

Linux Distros Unpatched Vulnerability : CVE-2025-6710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of...

Linux Distros Unpatched Vulnerability : CVE-2023-1409

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already known to work securely ...

Linux Distros Unpatched Vulnerability : CVE-2025-10061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of...

Linux Distros Unpatched Vulnerability : CVE-2025-6712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in...

Linux Distros Unpatched Vulnerability : CVE-2025-6706

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have...

Linux Distros Unpatched Vulnerability : CVE-2025-7259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorized user can issue queries with duplicate id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can on...

Linux Distros Unpatched Vulnerability : CVE-2024-8654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This...

Linux Distros Unpatched Vulnerability : CVE-2025-3085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the...

Linux Distros Unpatched Vulnerability : CVE-2025-6711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered...

Linux Distros Unpatched Vulnerability : CVE-2025-6707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This...