CVE-2020-7924 Specific command line parameter might result in accepting invalid certificate

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

CVE-2020-7924

CVE-2020-7924 describes an improper certificate validation flaw in MongoDB Tools caused by using a command-line parameter that was intended to skip hostname checks but can cause all certificate validation to be bypassed. Affected are MongoDB Database Tools versions: 3.6.x after 3.6.5 and before 3...

CVE-2020-7924

Removed by vendor...

PT-2021-2652 · Mongodb · Mongodb Database Tools

Name of the Vulnerable Software and Affected Versions: MongoDB Database Tools versions 3.6.6 through 3.6.20 MongoDB Database Tools versions prior to 3.6.21 MongoDB Database Tools versions prior to 4.0.21 MongoDB Database Tools versions prior to 4.2.11 MongoDB Database Tools 100 versions prior to...

Specific command line parameter might result in accepting invalid certificate

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

Dell Wyse Management Suite < 3.2 Multiple Vulnerabilities (DSA-2021-070)

The version of Dell Wyse Management Suite installed on the remote Windows host is prior to 3.2. It is, therefore, affected by multiple vulnerabilities, including the following: - Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an...

CVE-2021-20334

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

CVE-2021-20334

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

Design/Logic Flaw

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

CVE-2021-20334

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

CVE-2021-20334

CVE-2021-20334 is a local privilege escalation affecting MongoDB Compass on Windows. A malicious third party with local access can execute arbitrary software with the privileges of the user running MongoDB Compass. Affected products include MongoDB Compass 1.x (starting with 1.3.0 on Windows) and...

CVE-2021-20334 Local privilege escalation in MongoDB Compass for Windows

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

Mongodb Server 安全漏洞

Mongodb Server is the United States Mongodb company's set of open source NoSQL database . The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB that allows privileged execution of arbitrary software...

Local privilege escalation in MongoDB Compass for Windows

A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x...

Remote Code Execution (RCE)

mongodb-query-parser is vulnerable to remote code execution RCE. The vulnerability exists through the use of unsafe version of safer-eval, and context-eval in the older versions. This vulnerability is related to CVE-2019-10769...

MongoDB mongo-c-driver suffers from denial of service vulnerability

MongoDB is a nosql database based on distributed file storage. A denial of service vulnerability exists in MongoDB mongo-c-driver. An attacker can exploit this vulnerability to cause access out of bounds...

Rocket.Chat: Post-Auth Blind NoSQL Injection in the users.list API leads to Remote Code Execution

Summary: The users.list API endpoint is vulnerable to NoSQL injection attacks. It can be used to take over accounts by leaking password reset tokens and 2FA secrets. Taking over an admin account leads to Remote Code Execution. Description: The users.list API endpoint takes a custom query via the...

Rocket.Chat: Pre-Auth Blind NoSQL Injection leading to Remote Code Execution

Summary: The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taking over an admin account leads to Remote Code Execution. Description: The getPasswordPolicy...

Prototype Pollution in automattic/mongoose

✍️ Description Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Mongoose supports both promises and callbacks. mongoose.Schema is subject to prototype pollution due to the recursively calling of Schema.prototype.add function to add new items into the...

Moderate: Red Hat Security Advisory: Red Hat Integration Debezium 1.4.2 security update

An update for Debezium MongoDB connector is now available for Red Hat Integration. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...