User may override a view's collation and gain unauthorized access to underlying data

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version...

PT-2025-14096

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 5.0 prior to 5.0.31 MongoDB Server versions 6.0 prior to 6.0.20 MongoDB Server versions 7.0 prior to 7.0.16 MongoDB Server versions 8.0 prior to 8.0.4 Description The issue arises when the explain command is run with...

MongoDB -- crash due to improper validation of explain command

[email protected] reports: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to...

MongoDB Server 访问控制错误漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server that stems from the possibility that an...

MongoDB Server 安全漏洞

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A denial of service vulnerability exists in MongoDB Server. The vulnerability...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication, and automatic failover. A security vulnerability exists in MongoDB Server that stems from a failure to check the...

MongoDB -- Unauthorized access to underlying data

[email protected] reports: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, Mongo...

PT-2025-14095

Name of the Vulnerable Software and Affected Versions MongoDB versions prior to 5.0.31 MongoDB versions prior to 6.0.20 MongoDB versions prior to 7.0.16 Description Specifically crafted MongoDB wire protocol messages can cause MongoDB to crash during command validation. This issue can occur witho...

MongoDB -- Malformed wire protocol messages may cause mongos to crash

[email protected] reports: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to6.0.20 and MongoDB v7...

MongoDB Shell Installed (MacOSX)

Binary data mongodbshellmacosinstalled.nbin...

MongoDB Shell Installed (Windows)

Binary data mongodbshellwininstalled.nbin...

The vulnerability of the bson.Append() function in the Libson library’s MongoDB driver for MongoDB database management systems allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the bson.Append function in the Libson library for MongoDB’s C driver of the MongoDB database management system is related to the issue of operations occurring outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code or...

ROS-20250326-02

A vulnerability in the document-oriented MongoDB database management system is related to the lack of authorization checks. authorization checks. Exploitation of the vulnerability could allow a remote intruder gain unauthorized access to protected information...

ROS-20250326-03

The vulnerability in the document-oriented database management system MongoDB is related to bugs in the query analysis of some complex self-referential $lookup subconvectors, leading to sending to the server literal values in expressions for encrypted fields as plaintext instead of encrypted text...

CVE-2025-0755

The various bsonappend functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible application crash. This...

PT-2025-28209

Name of the Vulnerable Software and Affected Versions: MongoDB Server version 8.1.0 Description: An authorized user can issue queries with duplicate id fields, leading to unexpected behavior in MongoDB Server, which may result in a crash. This issue can only be triggered by authorized users and...

MongoDB 6.0.x < 6.0.17 / 7.0.x < 7.0.13 / 7.3.x < 7.3.4 incorrect enforcement of index constraints (SERVER-92382)

The version of MongoDB installed on the remote host is prior to 6.0.17, 7.0.13 and 7.3.4. It is, therefore, affected by a vulnerability as referenced in the SERVER-92382 advisory. - PrepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries...

DEBIAN-CVE-2025-0755

The various bsonappend functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible application crash. This...

CVE-2025-0755

The various bsonappend functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible application crash. This...

UBUNTU-CVE-2025-0755

The various bsonappend functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size INT32MAX, resulting in a segmentation fault and possible application crash. This...