MongoDB Compass < 1.42.2 Code Injection (macOS)

The version of MongoDB Compass installed on the remote host is affected by a code injection vulnerability. MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. Note that Nessus ha...

Security Bulletin: Vulnerabilities in Linux Kernel, MongoDB, Python, Samba, OpenSSL and cURL libcurl affect IBM Spectrum Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in libcurl, MongoDB, Python, Samba, OpenSSL and Linux. Vulnerabilities include obtaining sensitive information, causing a denial of service condition, the elevation of privileges, remote execution of arbitrary code and bypassing...

MongoDB Shell < 2.3.0 Control Character Injection (MONGOSH-2028)

The version of MongoDB Shell installed on the remote host is prior to 2.3.0. It is, therefore, affected by a vulnerability as referenced in the MONGOSH-2028 advisory. - mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a...

MongoDB Shell < 2.3.9 Control Character Injection (MONGOSH-2024, MONGOSH-2025, MONGOSH-2026)

The version of MongoDB Shell installed on the remote host is prior to 2.3.9. It is, therefore, affected by a vulnerability as referenced in the MONGOSH-2024, MONGOSH-2025, MONGOSH-2026 advisories. - The MongoDB Shell may be susceptible to control character injection where an attacker with control...

MongoDB Server Denial of Service Vulnerability (CNVD-2025-15801)

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A denial of service vulnerability exists in MongoDB Server. The vulnerability...

The vulnerability of the binary file mongocryptd and the library mongocryptv1.so of the MongoDB database management system, which involves the transmission of critical information in plaintext, allows attackers to gain unauthorized access to protected information.

The vulnerability of the binary file mongocryptd and the MongoDB database library v1.so involves the transmission of critical information in plaintext. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the MongoDB database management system server, related to the absence of authentication procedures, allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the MongoDB database management system server is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility of the protected information...

FreeBSD : MongoDB -- crash due to improper validation of explain command (350b3389-107f-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 350b3389-107f-11f0-8195-b42e991fc52e advisory. [email protected] reports: When run on commands with certain arguments set, explain may fail to validate...

FreeBSD : MongoDB -- Unauthorized access to underlying data (30418b26-107f-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 30418b26-107f-11f0-8195-b42e991fc52e advisory. [email protected] reports: A user authorized to access a view may be able to alter the intended collation...

FreeBSD : MongoDB -- Malformed wire protocol messages may cause mongos to crash (32f5e57f-107f-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 32f5e57f-107f-11f0-8195-b42e991fc52e advisory. [email protected] reports: Specifically crafted MongoDB wire protocol messages can cause mongos to crash...

Exploit for CVE-2024-53900

CTF Challenge - Mongoose RCE CVE-2024-53900 Challenge Overvie...

CVE-2025-3085

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

CVE-2025-3082

A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version...

CVE-2025-3084

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

CVE-2025-3083

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0...

MongoDB Shell Installed (Linux)

Binary data mongodbshelllinuxinstalled.nbin...

CVE-2025-3084

When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Serve...

CVE-2025-3085

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

CVE-2025-3083

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to...

UBUNTU-CVE-2025-3083

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to...