Sql injection

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20...

CVE-2020-7929 Specially crafted regex query can cause DoS

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20...

CVE-2020-7929 Specially crafted regex query can cause DoS

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20...

CVE-2020-7929

Removed by vendor...

CVE-2020-7929

MongoDB DoS via a specially crafted regex in a query (CVE-2020-7929) affects MongoDB Server v3.6 before 3.6.21 and v4.0 before 4.0.20. Root cause: processing a regex-containing query can trigger denial of service. Impact: availability loss (Partial/High in CVSS). Remediation: upgrade to MongoDB 3...

MongoDB 安全漏洞

Mongodb Server is the United States Mongodb company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A denial of service vulnerability exists in MongoDB Server, which originates...

Mongodb Server 输入验证错误漏洞

MongoDB is a document-oriented database management system from the U.S.-based MongoDB, Inc. An input validation error vulnerability exists in MongoDB Server v4.0 versions prior to 4.0.6, which originates from a user authorized to perform a specific type of query may be able to trigger a denial of...

PT-2021-8843 · Mongodb · Mongodb Server +1

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 4.0.6 MongoDB Server versions prior to 3.6.11 Description: A user authorized to perform a specific type of query may trigger a denial of service by issuing a generic explain command on a find query...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an unknown impact and attack vector. CVSS Base score: ...

Security Bulletin: IBM Cloud Private is vulnerable to MongoDB vulnerabilities (CVE-2020-7926, CVE-2020-7925, CVE-2020-7928)

Summary IBM Cloud Private is vulnerable to MongoDB vulnerabilities Vulnerability Details CVEID: CVE-2020-7926 DESCRIPTION: MongoDB Server is vulnerable to a denial of service. By sending specially-crafted queries, a remote authenticated attacker could exploit this vulnerability to cause the syste...

Security Bulletin: IBM Cloud Private is vulnerable to a MongoDB vulnerability (CVE-2020-7923)

Summary IBM Cloud Private is vulnerable to a MongoDB vulnerability Vulnerability Details CVEID: CVE-2020-7923 DESCRIPTION: MongoDB is vulnerable to a denial of service, caused by a flaw in geoNear invariant. By sending specially crafted queries, a remote authenticated attacker could exploit this...

Man-in-the-Middle (MitM)

mongodb-client-encryption is vulnerable to man-in-the-middle attacks. The module does not perform correct validation of the KMS servers certificate and would potentially allow for man-in-the-middle attackers to intercept and modify network traffic...

Insecure Hostname Verification

MongoDB Driver performs insecure hostname verification. The use of client-side encryption leads to an insecure host name verification in KMS servers certificate, allowing a MITM with a privileged network position to intercept the traffic between the Java driver and the KMS service rendering...

Vulnerabilities fixed in MongoDB

Vulnerabilities have been fixed in MongoDB. The vulnerabilities allow an unauthorized remote malicious person to obtain opportunity to obtain sensitive data. The malicious party must perform a successful man-in-the-middle attack that undoes the encryption of data is undone. Exploiting this...

Specially crafted regex query can cause DoS

A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20...

Invariant failure when explaining a find with a UUID

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.6; MongoDB Server v3.6 versions prior to 3.6.11...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

Design/Logic Flaw

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

CVE-2021-20328 MongoDB Java driver client-side field level encryption not verifying KMS host name

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...