MongoDB Server Security Vulnerability

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication, and automatic failover. A security vulnerability exists in MongoDB Server that stems from a lack of authorization checki...

MongoDB Compass Security Vulnerability

MongoDB Compass is a free interactive tool from the US-based MongoDB Inc. for querying, optimizing and analyzing MongoDB data. A security vulnerability previously existed in MongoDB Compass version 1.42.2, which stemmed from a possible bypass of the ejson shell parser...

GO-2024-2550 MongoDB Tools Improper Certificate Validation vulnerability in github.com/mongodb/mongo-tools

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates. NOTE: this module uses its own versioning scheme that is not fully...

PT-2024-6680 · Mongodb +4 · Libbson +4

Name of the Vulnerable Software and Affected Versions: libbson versions prior to 1.26.2 Description: The issue is related to an integer overflow in the bson strfreev function of the MongoDB C driver library, which may lead to memory corruption. This could potentially allow an attacker to impact t...

Astra Linux – Vulnerability in mongo-c-driver

When calling bsonutf8validate on certain inputs, it is possible for an infinite loop to occur, with no way to exit. This issue affects All MongoDB C Driver versions prior to version 1.25.0...

OESA-2024-1725 wireshark security update

Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer. Security Fixes: MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter-fips, up, weaviate, terraform-docs, step-issuer, kaniko, tailscale, kube-logging-operator, kubernetes-csi-external-provisioner, bank-vaults-fips, nfs-subdir-external-provisioner-fips, aws-load-balancer-controller, spqr,...

GHSA-M87M-MMVP-V9QM PyMongo Out-of-bounds Read in the bson module

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

DEBIAN-CVE-2024-5629

An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory...

PyMongo Security Vulnerabilities

PyMongo is an official MongoDB Python driver for the MongoDB open source. A security vulnerability exists in PyMongo version 4.6.2 and earlier, which stems from an out-of-bounds read problem in the bson module...

Ars0N-Framework - A Modern Framework For Bug Bounty Hunting

Howdy! My name is Harrison Richardson, or rs0n arson when I want to feel cooler than I really am. The code in this repository started as a small collection of scripts to help automate many of the common Bug Bounty hunting processes I found myself repeating. Over time, I built a simple web...

MongoDB 5.0.x < 5.0.25 / 6.0.x < 6.0.14 / 7.0.x < 7.0.6 Improper Input Validation (SERVER-85263)

The version of MongoDB installed on the remote host is prior to 5.0.25, 6.0.14, or 7.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-85263 advisory. - Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be...

MongoDB DoS Vulnerability (SERVER-75601) - Linux

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

MongoDB Improper Validation Vulnerability (SERVER-85263) - Linux

MongoDB is prone to an improper validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

MongoDB DoS Vulnerability (SERVER-75601) - Windows

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

MongoDB Improper Validation Vulnerability (SERVER-85263) - Windows

MongoDB is prone to an improper validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

CVE-2024-3372

A vulnerability was found in MongoDB. A remote, unauthenticated attacker could trigger the flaw by providing an invalid BSON. This issue can cause the server to incorrectly serialize the file, impacting the availability and integrity...

CVE-2024-3374

A flaw was found in MongoDB. This flaw allows an unauthenticated user to trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and...

Wireshark 3.6.x < 3.6.23 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.6.23. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.23 advisory. - MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0...

CVE-2024-3374

An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions...