UBUNTU-CVE-2016-6494

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files...

Information disclosure

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files...

CVE-2016-6494

CVE-2016-6494 (MongoDB): The MongoDB client stores .dbshell history files with world‑readable permissions, enabling a local attacker to read history and potentially obtain sensitive information. This is a local information‑exposure issue. CVSS shows low base score (2.1/3.0) with local access requ...

CVE-2016-6494

Removed by vendor...

CVE-2016-6494

The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files...

[SECURITY] Fedora 25 Update: mongodb-3.2.8-2.fc25

Mongo from "humongous" is a high-performance, open source, schema-free document-oriented database. MongoDB is written in C++ and offers the follow ing features: Collection oriented storage: easy storage of object/JSON-style data Dynamic queries Full index support, including on inner objects and...

RockMongo has multiple vulnerabilities

RockMongo is a PHP5 written MongoDB management tool . Cross-site request forgery and cross-site scripting vulnerabilities exist in RockMongo version 1.1.8. An attacker can exploit the vulnerabilities to execute arbitrary and scripted code within a user's browser session in the context of an...

Cartero - Social Engineering Framework

A robust Phishing Framework with a full featured CLI interface. The project was born out necessity through of years of engagements with tools that just didn't do the job. Even though there are many projects out there, we were not able to find a suitable solution that gave us both easy of use and...

swarm - A Modular Distributed Penetration Testing Tool

Swarm is an open source modular distributed penetration testing Tool that use distributed task queue to implement communication in the master-slave mode system and use MongoDB for data storage. It consists of a distributed framework and function modules. The function module can be an entirely new...

High Performance DoS Analyzer: FastNetMon

High Performance DoS Analyzer FastNetMon – A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines NetFlow, IPFIX, sFLOW, SnabbSwitch, netmap, PFRING, PCAP. What can we do? We can detect hosts in our networks sending or receiving large volumes of...

[SECURITY] [DLA 588-2] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 This is an update of DLA-558-1. The previous build had revision number that was considered lower than the one in wheezy and was therefore not installed at upgrade. The text for DLA-558-1 is included here...

Malware DNA Profiling Search Engine: CodexGigas

Malware DNA Profiling Search Engine Codex Gigas malware DNA profiling search engine discovers malware patterns and characteristics assisting individuals who are attracted in malware hunting. Codex Gigas is a malware profiling search engine that allows malware hunters and analysts to truly...

Debian DLA-588-2 : mongodb security update

This is an update of DLA-588-1. The previous build had revision number that was considered lower than the one in wheezy and was therefore not installed at upgrade. The text for DLA-588-1 is included here for reference with some improvement. Two security related problems have been found in the...

DLA-588-2 mongodb - regression update

Bulletin has no description...

[SECURITY] [DLA 588-1] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 Two security related problems have been found in the mongodb package, related to logging. CVE-2016-6494 World-readable .dbshell history file TEMP-0833087-C5410D Bruteforcable challenge responses in...

DLA-588-1 mongodb - security update

Bulletin has no description...

MongoDB phpMoAdmin Unauthenticated Remote Code Execution (CVE-2015-2208)

A remote code execution vulnerability exists in MongoDB administration tool for PHP. The vulnerability is due to insufficient validation of user supplied input when processing HTTP requests. A remote authenticated attacker could exploit this vulnerability by sending a malicious request...

MongoDB Client Information Disclosure Vulnerability

MongoDB is a database based on distributed file storage. A security vulnerability exists in MongoDB that could lead to the disclosure of sensitive user information...

mongodb: DoS due to improper BSON validation

A flaw was found in the way MongoDB processed certain BSON-serialized UTF-8 strings. A remote, unauthenticated attacker could use this flaw to crash a mongod server via a specially crafted BSON message...

WhoDat - Pivotable Reverse WhoIs / PDNS Fusion with Registrant Tracking & Alerting plus API for automated queries (JSON/CSV/TXT)

The WhoDat project is a front-end for whoisxmlapi data, or any whois data living in a MongoDB. It integrates whois data, current IP resolutions and passive DNS. In addition to providing an interactive, pivotable application for analysts to perform research, it also has an API which will allow...