Vulnerabilities > Mongodb
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2018-09-10 | CVE-2018-16790 | Out-of-bounds Read vulnerability in Mongodb Libbson 1.12.0 _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer. | 5.8 |
2018-07-10 | CVE-2018-13863 | Unspecified vulnerability in Mongodb Js-Bson The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. | 5.0 |
2018-07-06 | CVE-2017-2665 | Insufficiently Protected Credentials vulnerability in multiple products The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. | 1.9 |
2017-11-01 | CVE-2017-15535 | Unspecified vulnerability in Mongodb MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory. | 6.4 |
2017-09-09 | CVE-2017-14227 | Out-of-bounds Read vulnerability in Mongodb 1.7.0 In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c. | 5.0 |
2017-06-06 | CVE-2014-8180 | Improper Authentication vulnerability in Mongodb MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service. | 2.1 |
2017-04-14 | CVE-2016-3104 | Resource Exhaustion vulnerability in Mongodb 2.4.0/2.6.0 mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and process termination) by leveraging in-memory database representation when authenticating against a non-existent database. | 5.0 |
2016-10-03 | CVE-2016-6494 | Information Exposure vulnerability in multiple products The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files. | 5.5 |
2015-03-30 | CVE-2015-1609 | Improper Input Validation vulnerability in multiple products MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request. | 5.0 |
2014-12-25 | CVE-2014-3971 | Improper Input Validation vulnerability in Mongodb 2.6.0/2.6.1 The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate. | 5.0 |