CloudBees Jenkins MongoDB Privilege Control Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A security vulnerability exis...

CVE-2020-2268

A cross-site request forgery CSRF vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-2267

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-2267

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-2268

A cross-site request forgery CSRF vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-2268

CVE-2020-2268 applies to Jenkins MongoDB Plugin 1.3 and earlier. The CSRF vulnerability arises because methods implementing form validation do not perform permission checks, allowing attackers with Overall/Read permission to access metadata of arbitrary files on the Jenkins controller. The form v...

CVE-2020-2267

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller...

CVE-2020-2267

CVE-2020-2267 affects Jenkins MongoDB Plugin versions 1.3 and earlier, where a missing permission check allows users with Overall/Read to access metadata of arbitrary files on the Jenkins controller. The issue is described across multiple sources (Red Hat, NVD, CNVD, GHSA, OSV, etc.) with the cor...

CVE-2020-2268

A cross-site request forgery CSRF vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller...

PT-2020-15492 · Jenkins · Jenkins Mongodb Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MongoDB Plugin versions 1.3 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller...

PT-2020-15493 · Jenkins · Jenkins Mongodb Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins MongoDB Plugin versions 1.3 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller. This issue arises because the plug...

@mongodb-js/compass-aggregations (>=0.0.20 <=4.1.0), @mongodb-js/compass-export-to-language (>=2.2.22 <=2.2.24) +4 more potentially affected by unknown CVE via mongodb-query-parser (>=0.0.1 <=1.5.0)

mongodb-query-parser NPM version =0.0.1, =0.0.20, =2.2.22, =0.0.3, =3.0.0, =1.0.3, =0.0.1, =0.4.2 Source cves: unknown CVE Source advisory: OSV:GHSA-97MG-3CR6-3X4C...

Remote Code Execution in mongodb-query-parser

Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return clearImmediate.constructor"return...

GHSA-97MG-3CR6-3X4C Remote Code Execution in mongodb-query-parser

Versions of mongodb-query-parser prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes touch test-file: 'function return clearImmediate.constructor"return...

02-sms-async (=1.0.0), 10tcl (=0.0.1) +8554 more potentially affected by unknown CVE via mongodb (>=0.9.1 <=3.1.12)

mongodb NPM version =0.9.1, =1.0.1, =1.0.7, =0.0.1, =0.0.2, =0.3.0, =0.1.4, =0.0.1, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MH5C-679W-HH4R...

Denial of Service in mongodb

Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. Recommendation Upgrade to version 3.1.13 or later...

GHSA-MH5C-679W-HH4R Denial of Service in mongodb

Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. Recommendation Upgrade to version 3.1.13 or later...

Malicious Package in mogodb-core

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

NoSQL Injection in loopback-connector-mongodb

Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later...