Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 233

Export CSV
CVE-2019-2389

Process termination via PID file manipulation

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2019-20925

Denial of service via malformed network packet

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2019-20924

Invariant in IndexBoundsBuilder

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2019-20923

Crash while handling internal Javascript exception types

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Mongodb
Products
Mongodb Mongodb Server
CVE-2018-25004

Invariant failure when explaining a find with a UUID

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

CVSS 3.1 · 4.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2018-20805

Invariant with $elemMatch

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2018-20804

Invariant failure in applyOps

A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2018-20803

Infinite loop in aggregation expression

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2018-20802

Post-auth queries on compound index may crash mongod

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2017-2665

rhscon-core: creates world readable file /etc/skyring/skyring.conf which leaks mongodb password for skyring database

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb Redhat
Products
Mongodb Storage Console
CVE-2015-7882

Authentication bypass when using LDAP authentication in MongoDB Enterprise Server

Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

CVSS 3.0 · 8.1 High EPSS 1.8% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2024-8305

MongoDB Server secondaries may crash due to forced index constraints

prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Mongodb
CVE-2024-7553

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Mongodb
Products
Windows 10 1507 Windows 10 1511 Windows 10 1607 and 21 more