Information disclosure

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and c...

CVE-2021-20335 SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and c...

CVE-2021-20335

CVE-2021-20335 affects MongoDB Ops Manager versions up to 4.2.24 and up to 4.4.12 when SSL is enabled for MongoDB processes; during upgrade, Automation may temporarily disable SSL on cluster members due to a bug, until upgrades complete. Impact requires clientCertificateMode=OPTIONAL or allowConn...

PT-2021-13892 · Mongodb · Mongodb Ops Manager

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions prior to and including 4.2.24 MongoDB Ops Manager versions prior to and including 4.4.12 Description: The issue occurs when upgrading MongoDB Ops Manager from versions prior to and including 4.2.24 to versions pri...

CVE-2021-20335: Cleartext Transmission of Sensitive Information

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager versions prior to and including 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and c...

MongoDB Ops Manager Security Vulnerability

MongoDB Ops Manager is a solution from MongoDB USA that supports managing, monitoring and backing up MongoDB deployments. A security vulnerability exists in MongoDB Ops Manager that stems from an error triggered by upgrading to MongoDB Ops Manager 4.4.X with SSL turned on in MongoDB...

SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager

For MongoDB Ops Manager = 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager = 4.4.12 triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This...

Oracle Enterprise Manager Ops Center (Jan 2021 CPU)

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory. - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager component: Control Proxy Apache HT...

I Am Not a Soldier, but I Have Been Trained to Kill

A sprawling tactical industry is teaching American civilians how to fight like Special Ops forces. By preparing for violence at home, are they calling it into being?...

Improper certificate validation vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer

Overview The Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer contains improper certificate validation vulnerability. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the...

Cleartext Transmission of Sensitive Information Vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer

Overview The Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer contains a cleartext transmission of sensitive information vulnerability due to incomplete document. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer t...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

Potential privilege escalation in Ops Manager API

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions 4.2.0-4.2.17, v4.3 versions 4.3.0-4.3.9 and v4.4 versions 4.4.0-4.4.2...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

Privilege escalation

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927 Potential privilege escalation in Ops Manager API

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927

CVE-2020-7927 affects MongoDB Ops Manager; a specially crafted API call can let an authenticated user with Organization Owner privilege obtain an API key with Global Role privilege. Affected releases include Ops Manager v4.2.x up to 4.2.17, v4.3.x up to 4.3.9, and v4.4.x up to 4.4.2. The issue is...

PT-2020-19852 · Mongodb · Mongodb Ops Manager

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions prior to and including 4.2.17 MongoDB Ops Manager versions prior to and including 4.3.9 MongoDB Ops Manager versions prior to and including 4.4.2 Description: Specially crafted API calls may allow an authenticated...