CVE-2022-31551

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path traversal

The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

flask-mongo-skel 路径遍历漏洞

flask-mongo-skel is a Flask MongoDB framework from Shamail Tayyab's personal developer. flask-mongo-skel 2012-11-01 and earlier versions contain a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter resource or file paths for The vulnerability is...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Malicious code in bfx-facs-db-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7673e8b6a14af3814a12ce10f7a83cb13821adae60918e914bca452b1bf8cc7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1519 Malicious code in bfx-facs-db-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7673e8b6a14af3814a12ce10f7a83cb13821adae60918e914bca452b1bf8cc7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bcoin-mongo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b87b09d27793d80c018b01839a3055f8291ea7e7399a2986a040821aa9f141dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1480 Malicious code in bcoin-mongo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b87b09d27793d80c018b01839a3055f8291ea7e7399a2986a040821aa9f141dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bcoin-mongo-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60b502cd2230d7460f774b28808ee0919a97069cc001cd8dc7465a3a0f8ba937 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1481 Malicious code in bcoin-mongo-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60b502cd2230d7460f774b28808ee0919a97069cc001cd8dc7465a3a0f8ba937 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongo.rabbit.bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef04fad2f4cc89e04245dbb8e3687a649270fe37322fcdb204d24c2a54398277 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-4943 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5 Description: An information disclosure issue exists due to insufficient input validation in the actionLinkHandler method, allowing Message...

mongo-rest-api (0.1.0), pine-ql (>=0.1.0, <=0.5.4) potentially affected by CVE-2020-28272 via keyget (1.0.1)

keyget NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on keyget and may be impacted: - mongo-rest-api 0.1.0 - pine-ql =0.1.0, =0.5.4 Source cves: CVE-2020-28272 Source advisory: OSV:GHSA-8MP8-28XH-R486...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-08ae2dd481)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-3a63897745)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-mongodb-mongo-driver (FEDORA-2022-5cbd6de569)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

mongo-rest-api (0.1.0), pine-ql (>=0.1.0, <=0.5.4) potentially affected by CVE-2020-28272 +1 more via keyget (1.0.1)

keyget NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on keyget and may be impacted: - mongo-rest-api 0.1.0 - pine-ql =0.1.0, =0.5.4 Source cves: CVE-2020-28272, CVE-2021-23760 Source advisory: SNYK:JS-KEYGET-2342624...

Rocket.Chat: API route chat.getThreadsList leaks private message content

Summary The /api/v1/chat.getThreadsList does not sanitize user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection. Description The chat.getThreadsList API route is defined in app/api/server/v1/chat.jsL522-L572: javascript const rid, type, text =...

MongoDB mongo-express Remote Code Execution Vulnerability

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method...

bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2021-23372 via mongo-express (>=0.19.0, <=0.53.0)

mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2021-23372 Source advisory: OSV:GHSA-M2R3-8492-VX59...