Specific GeoQuery can cause DoS against MongoDB Server

A user authorized to perform database queries may cause denial of service by issuing specially crafted queries, which violate an invariant in the query subsystem's support for geoNear. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc7; v4.2 versions prior to 4.2.8;...

Exploit for Path Traversal in Igniterealtime Openfire

PoC exploit for CVE-2019-18393 and CVE-2019-18394, which are related to MongoDB and Redis vulnerabilities. The repository contains information on how to exploit these vulnerabilities, including a demonstration of how an attacker can gain unauthorized access to a MongoDB database and a Redis serve...

The vulnerability of the document-oriented database management system MongoDB, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the document-oriented database management system MongoDB is related to authentication errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

[SECURITY] Fedora 31 Update: python-flask-admin-1.5.6-1.fc31

Flask-Admin is advanced, extensible and simple to use administrative interf ace building extension for Flask framework. It comes with batteries included: model scaffolding for SQLAlchemy, MongoEngine, MongoDB and Peewee ORMs, simple file management interface and a lot of usage samples. You're not...

[SECURITY] Fedora 32 Update: python-flask-admin-1.5.6-1.fc32

Flask-Admin is advanced, extensible and simple to use administrative interf ace building extension for Flask framework. It comes with batteries included: model scaffolding for SQLAlchemy, MongoEngine, MongoDB and Peewee ORMs, simple file management interface and a lot of usage samples. You're not...

Fedora: Security Advisory for python-flask-admin (FEDORA-2020-e8f384af5f)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

47% of online MongoDB databases hacked demanding ransom

By Sudais Asif The hackers also threatened to inform GDPR officials if the ransom is not paid. This is a post from HackRead.com Read the original post: 47% of online MongoDB databases hacked demanding ransom...

CVE-2020-2217

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2217

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

Cross site scripting

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2020-2217

The CVE-2020-2217 issue affects Jenkins Compatibility Action Storage Plugin versions 1.0 and earlier. The root cause is that the plugin does not escape content coming from MongoDB in the testConnection form validation endpoint, leading to a reflected XSS vulnerability. Impact is reflected XSS as ...

PT-2020-15433 · Jenkins · Jenkins Compatibility Action Storage Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Compatibility Action Storage Plugin versions 1.0 and earlier Description: The issue is related to a reflected cross-site scripting XSS vulnerability. It occurs because the plugin does not escape the content coming from the MongoDB in...

Reflected XSS in compatibility-action-storage

compatibility-action-storage 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint. This allows attackers able to update the configured document in MongoDB to inject the payload. This results in a reflected cross-site scripting XSS...

CVE-2020-2217: Improper Neutralization of Input During Web Page Generation

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting XSS vulnerability...

FreeBSD : MongoDB -- Ensure RoleGraph can serialize authentication restrictions to BSON (d0be8e1f-b19a-11ea-94aa-b827eb2f57d4)

reports : Improper serialization of MongoDB Server's internal authorization state permits a user with valid credentials to bypass IP source address protection mechanisms following administrative action. Credit Discovered by Tony Yesudas. C Tenable Network Security, Inc. The descriptive text and...

GitHub Security Lab: Golang : Add MongoDb NoSQL injection sinks

This bug was reported directly to GitHub Security Lab...

CVE-2020-7921

A vulnerability was discovered in MongoDB, where an update operation on a user-define role clears the authenticationRestrictions field that was previously set. This unexpected behavior may remove previous IP based restrictions configured on a role, thus allowing a user to bypass them once the...

Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)

Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...

PT-2020-6164 · Mongodb +1 · Mongodb Server +2

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 3.6.21 MongoDB Server versions prior to 4.0.20 Description: A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries containing a type of regex. This iss...

MongoDB Ops Manager Information Disclosure Vulnerability

MongoDB Ops Manager is a MongoDB USA solution that supports managing, monitoring and backing up MongoDB deployments. A security vulnerability exists in MongoDB Ops Manager versions 4.0.9, 4.0.10, and 4.1.5. An attacker could exploit the vulnerability to view specific access logs for publicly...