PT-2014-2388

Name of the Vulnerable Software and Affected Versions MongoDB versions prior to 2.3.2 Description The issue concerns the default configuration of MongoDB, where objects are not validated. This allows remote authenticated users to cause a denial of service or read system memory by sending a crafte...

Automated NoSQL Database Injection Attacks: NoSQLMap

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to Bernardo Damele and...

MongoDB < 2.3.2 BSON Object Length Handling Memory Disclosure

The version of the remote MongoDB server is a version prior to 2.3.2. It is, therefore, potentially affected by an information disclosure vulnerability. An error exists related to handling BSON Binary JavaScript Object Notation objects having incorrect length that could allow possible disclosure ...

MongoDB 2.x REST Interface RCE Vulnerability (Nov 2012) - Active Check

MongoDB is prone to a remote code execution RCE vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

[NOSQLMap] NoSQLMap-Automated NoSQL Database pwnage

What is NoSQLMap? NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases, as well as web applications using NoSQL in order to disclose data from the database. It is named as a tribute to...

CVE-2013-6384

1 impldb2.py and 2 implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information the DB2 or MongoDB password by reading the log file...

Design/Logic Flaw

1 impldb2.py and 2 implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information the DB2 or MongoDB password by reading the log file...

CVE-2013-6384

1 impldb2.py and 2 implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information the DB2 or MongoDB password by reading the log file...

CVE-2013-6384

1 impldb2.py and 2 implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information the DB2 or MongoDB password by reading the log file...

MongoDB nativeHelper DoS Vulnerability

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

MongoDB engine_v8 DoS Vulnerability

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

CVE-2013-3969

The find prototype in scripting/enginev8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service uninitialized pointer dereference and server crash or possibly execute arbitrary code via an invalid RefDB object...

CVE-2013-1892

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory access and server crash or execute arbitrary code via a crafted memory address in the...

Design/Logic Flaw

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory access and server crash or execute arbitrary code via a crafted memory address in the...

CVE-2013-1892

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory access and server crash or execute arbitrary code via a crafted memory address in the...

CVE-2013-3969

The find prototype in scripting/enginev8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service uninitialized pointer dereference and server crash or possibly execute arbitrary code via an invalid RefDB object...

Null pointer dereference

The find prototype in scripting/enginev8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service uninitialized pointer dereference and server crash or possibly execute arbitrary code via an invalid RefDB object...

CVE-2013-1892

CVE-2013-1892 affects MongoDB before 2.0.9 and 2.2.x before 2.2.4, where requests to the nativeHelper function in SpiderMonkey aren’t validated, allowing remote authenticated users to cause invalid memory access, server crash (DoS), or potentially arbitrary code execution via a crafted memory add...

CVE-2013-1892

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory access and server crash or execute arbitrary code via a crafted memory address in the...

CVE-2013-1892

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service invalid memory access and server crash or execute arbitrary code via a crafted memory address in the...