The vulnerability of the document-oriented MongoDB database management system, related to deficiencies in access control, allows a hacker to execute arbitrary code.

The vulnerability of the document-oriented MongoDB database management system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a special application...

TheTHE - Simple, Shareable, Team-Focused And Expandable Threat Hunting Experience

TheTHE is an environment intended to help analysts and hunters over the early stages of their work in an easier, unified and quicker way. One of the major drawbacks when dealing with a hunting is the collection of information available on a high number of sources, both public and private. All thi...

Semrush: Content Injection on api.semrush.com to Reflected XSS

The researcher found XSS vulnerability and wrote an awesome summary! : While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private Core Services (CVE-2019-2390, CVE-2019-2389)

Summary A Security Vulnerability affects IBM Cloud Private Core Services Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote authenticated attack...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private Core Services (CVE-2019-2386)

Summary A Security Vulnerability affects IBM Cloud Private Core Services Vulnerability Details CVEID: CVE-2019-2386 DESCRIPTION: MongoDB Server could allow a remote authenticated attacker to bypass security restrictions, caused by improper session management. By reusing an established session of...

Red Hat OpenShift Input Validation Error Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. An input validation error vulnerability in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh file in Red Hat...

CVE-2013-0165

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp...

Design/Logic Flaw

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp...

CVE-2013-0165

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp...

CVE-2013-0165

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp...

CVE-2013-0165

CVE-2013-0165 affects OpenShift: the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh script does not properly create files in /tmp. Affected component is the dump.sh script within the OpenShift MongoDB cartridge (version 2.2). Underlying issue is improper file creation in /tmp,...

CVE-2019-2389

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11;...

Security Bulletin: Multiple vulnerabilities in MongoDB server affect IBM Cloud App Management

Summary There are vulnerabilities in MongoDB used by IBM® Cloud App Management. IBM® Cloud App Management has addressed the applicable CVEs in a later version. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV...

GHSA-8687-VV9J-HGPH Improper Input Validation in Automattic Mongoose

Automattic Mongoose through 5.7.4 allows attackers to bypass access control in some applications because any query object with a bsontype attribute is ignored. For example, adding "bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around...

Denial Of Service (DoS)

mongodb is vulnerable to denial of service. Failure to properly catch an exception arising from an invalid collection name when a database does not exist results in an application crash...

FreeBSD : mongodb -- Attach IDs to users (880bca8f-e201-11e9-8af7-08002720423d)

Mitch Wasson of Cisco's Advanced Malware Protection Group reports : After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones...

FreeBSD : mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name. (273c6c43-e3ad-11e9-8af7-08002720423d)

Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports : Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. C Tenable...

FreeBSD : mongodb -- Bump Windows package dependencies (fd2e0ca8-e3ae-11e9-8af7-08002720423d)

Rich Mirch reports : An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server versions less than 4.0.11, 3.6.14, and 3.4.22 to run attacker defined code as the user running the...

CVE-2019-17426

Automattic Mongoose up to version 5.7.4 is affected. The root cause is that a query object containing a _bsontype attribute is ignored, which can bypass access control in some applications (e.g., a query filter interference with _bsontype). The CVE covers this behavior in older versions of the bs...

Denial of Service

Overview Versions of mongodb prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application. Recommendation Upgrade to version 3.1.13 or later. References GitHub Advisory...