CVE-2025-3084

CVE-2025-3084 affects MongoDB Server: 5.0 before 5.0.31, 6.0 before 6.0.20, 7.0 before 7.0.16, and 8.0 before 8.0.4. The root cause is improper validation of parameters for the explain command, which may be used to crash router servers. Impact is denial of service / crash (availability impact). R...

CVE-2025-3084 MongoDB Server may crash due to improper validation of explain command

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

CVE-2025-3084

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

CVE-2025-3084 MongoDB Server may crash due to improper validation of explain command

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

MongoDB Server may crash due to improper validation of explain command

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

PT-2025-14096

Name of the Vulnerable Software and Affected Versions MongoDB Server versions 5.0 prior to 5.0.31 MongoDB Server versions 6.0 prior to 6.0.20 MongoDB Server versions 7.0 prior to 7.0.16 MongoDB Server versions 8.0 prior to 8.0.4 Description The issue arises when the explain command is run with...

MongoDB Server security vulnerabilities

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A denial of service vulnerability exists in MongoDB Server. The vulnerability...

MongoDB -- crash due to improper validation of explain command

[email protected] reports: When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2024-55459 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2024-55459 Source advisory:...

keras-explain (0.0.1), scikit-keras (0.1.11) +3 more potentially affected by CVE-2024-55459 via keras (2.1.6)

keras PYPI version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-explain 0.0.1 - scikit-keras 0.1.11 - tensorflowjs =0.5.4, =0.5.2, =0.5.5 - tutti-aisthetics 0.0.3 Source cves: CVE-2024-55459 Source advisory:...

PingCAP TiDB security vulnerabilities

PingCAP TiDB is an open source, cloud-native, distributed, MySQL-compatible database for elastic scaling and real-time analytics from China-based PingCAP. A security vulnerability exists in PingCAP TiDB version v8.1.0, which stems from a buffer overflow issue contained in the...

BIT-PARSE-2021-39187 Crash server with query parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an...

BIT-DJANGO-2022-28347

A SQL injection issue was discovered in QuerySet.explain in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary with dictionary expansion as the options argument, and placing the injection payload in an option name...

PT-2023-31914

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 5.0.2 Description Lychee, a free photo-management tool, is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB LOG SQL=true a...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2023-28370 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2023-28370 Source advisory: OSV:GHSA-HJ3F-6GCP-JG8J...

brew-view (>=2.4.0, <=2.4.21), fast-explain (>=0.0.49, <=0.0.91) +6 more potentially affected by CVE-2023-28370 via tornado (5.1.0)

tornado PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - brew-view =2.4.0, =0.0.49, =0.9.0.2, =0.1.2, =0.10.2, =0.5.23, =0.6.0 Source cves: CVE-2023-28370 Source advisory: OSV:PYSEC-2023-75...

CVE-2023-30555

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the explain method in sqloptimize.py. User input coming from the dbname...

Sql injection

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the explain method in sqloptimize.py. User input coming from the dbname...

CVE-2023-30555

CVE-2023-30555 concerns Archery, an open-source SQL audit platform, with multiple SQL injection vulnerabilities in the explain endpoint. The root cause is that user input from the db_name parameter is passed to database engine queries (query methods in sql/engines/mssql.py and sql/engines/oracle....

CVE-2023-30555 SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the explain method in sqloptimize.py. User input coming from the dbname...