Deserialization of Untrusted Data in bson

Overview Versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type. Recommendation Upgrade to version 1.1.4 or...

Deserialization of Untrusted Data in bson

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type...

02-sms-async (=1.0.0), 10tcl (=0.0.1) +8851 more potentially affected by CVE-2020-7610 via bson (>=0.0.4 <=1.1.1)

bson NPM version =0.0.4, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.1.4, =0.0.1, =0.1.0, =1.0.0 and more Source cves: CVE-2020-7610 Source advisory: OSV:GHSA-V8W9-2789-6HHR...

GHSA-V8W9-2789-6HHR Deserialization of Untrusted Data in bson

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's bsontype, leading to cases where an object is serialized as a document rather than the intended BSON type...

USN-4812-1 libbson vulnerabilities

It was discovered that libbson incorrectly validated input length. An attacker could possibly use this issue to cause a denial of service. This issue affected only Ubuntu 16.04 ESM. CVE-2017-14227 It was discovered that libbson incorrectly handled certain specially crafted bson buffers. An attack...

2.5 bug fix update

An update is available for rubygem-bson, rubygem-mysql2, rubygem-bundler, ruby, rubygem-mongo, rubygem-pg, rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Integer Overflows

bson is vulnerable to Integer Overflows. It incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...

Moped Rubygem Data Injection Vulnerability

The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service worker resource consumption or perform a cross-site scripting XSS attack via a crafted string...

The vulnerability of the BSON parsing software package, caused by integer overflows, allows attackers to trigger a service failure.

The vulnerability of the BSON parsing software package arises due to a numerical overflow condition. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

FreeBSD : MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON (d0be8e1f-b19a-11ea-94aa-b827eb2f57d4)

reports : Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action. Credit Discovered by Tony Yesudas. C Tenable Network Security, Inc. The descriptive text and...

Ubiquiti Configuration Importer

This module imports an Ubiquiti device configuration. The db file within the .unf backup is the data file for Unifi. This module can take either the db file or .unf. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0 <=1.1.0), ai.platon.pulsar:pulsar-agentic (>=4.5.0 <=4.6.0) +5848 more potentially affected by CVE-2012-0881 via xerces:xercesImpl (>=2.10.0 <=2.11.0)

xerces:xercesImpl MAVEN version =2.10.0, =1.0.0, =4.5.0, =4.7.11, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =0.2, =5.0.9, =5.1.3 and more Source cves: CVE-2012-0881 Source advisory: OSV:GHSA-VMQM-G3VH-847M...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8 <=0.1.12), ai.snips:play-mongo-bson_2.12 (>=0.5 <=0.5.1) +6330 more potentially affected by CVE-2020-9547 via com.fasterxml.jackson.core:jackson-databind (>=2.8.0 <=2.8.11.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.8.0, =0.1.8, =0.5, =2.3.0, =1.5.6, =4.2.1, =4.4.1, =1.0.0.RELEASE, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.9 and more Source cves: CVE-2020-9547 Source advisory: OSV:GHSA-Q93H-JC49-78GG...

CVE-2020-12135

bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...

Denial of Service (DoS)

Overview bson is an a fully featured BSON specification implementation in Ruby. Affected versions of this package are vulnerable to Denial of Service DoS. The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby as used in rubygem-moped allows remote attackers to cause a denial of service work...

BSON rubygem contains potential denial of service

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

GHSA-QH4W-7PW3-P4RP BSON rubygem contains potential denial of service

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

Potential denial of service in bson rubygem

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...

CVE-2020-12135

bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...

CVE-2020-12135

bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeeded could have an integer overflow via properly constructed bson input...