6039 matches found
New Malware Combines Ransomware, Coin Mining and Botnet Features in One
Windows and Linux users need to beware, as an all-in-one, destructive malware strain has been discovered in the wild that features multiple malware capabilities including ransomware, cryptocurrency miner, botnet, and self-propagating worm targeting Linux and Windows systems. Dubbed XBash, the new...
js-bson vulnerable to REDoS
The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
Millions of Records Exposed in Veeam Misconfigured Server
UPDATE Hundreds of millions of records were exposed after a MongoDB server belonging to disaster-recovery firm Veeam was left misconfigured, researchers found. The open server contained a 200-gigabyte database with millions of records. Researcher Bob Diachenko, who discovered the misconfiguration...
SQL Injection
express-cart is vulnerable to SQL injection. A lack of user input sanitization in the login handlers allow attackers to inject MongoDB queries through the customer and admin login parameters. The vulnerability could be exploited to retrieve or modify arbitrary entries in the database...
Heap overflow
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
DEBIAN-CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790
CVE-2018-16790 affects libbson 1.12.0 (used by MongoDB’s libbson and the mongo-c-driver). The vulnerability is a heap-based buffer over-read triggered by a crafted BSON buffer in bson_iter_next_internal, as described for libbson 1.12.0. This can impact applications that consume BSON via the affec...
CVE-2018-16790
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
CVE-2018-16790: Out-of-bounds Read
bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer...
NoSQL Injection
loopback-connector-mongodb is susceptible to NoSQL injection attack. The buildWhere and buildSort functions fail to sanitize the filter passed to the database query, allowing the attacker to inject and execute arbitrary NoSQL queries...
NoSQL Injection
Overview Versions of loopback-connector-mongodb before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous $where property to be passed to the MongoDB Driver. The Driver allows the speci...
GHSA-JHQ3-57XH-6643 Privilege Escalation due to Blind NoSQL Injection in flintcms
Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...
Privilege Escalation due to Blind NoSQL Injection in flintcms
Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...
Node.js third-party modules: [express-cart] Customer and admin email enumeration through MongoDB injection
I would like to report an injection in express-cart It allows to enumerate the email address of the customers and the administrators. Module module name: express-cart version: 1.1.7 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully functional shopping...