CVE-2020-7610

bson: Deserialization of Untrusted Data could result in Code injection or Excessive CPU load

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Mongodb

Products

Bson

CVE-2020-12135

bson: integer overflow in bson_ensure_space() parameter bytesNeeded

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mongodb Whoopsie Project

Products

C Driver Whoopsie

CVE-2019-2393

Crash while joining collections with $lookup

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13 and MongoDB Server v3.6 versions prior to 3.6.15.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2019-2392

$mod can result in undefined behavior

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2019-2389

Process termination via PID file manipulation

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2019-20925

Denial of service via malformed network packet

An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2019-20924

Invariant in IndexBoundsBuilder

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2019-20923

Crash while handling internal Javascript exception types

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2018-25004

Invariant failure when explaining a find with a UUID

A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affects MongoDB Server v4.0 versions prior to 4.0.6 and MongoDB Server v3.6 versions prior to 3.6.11.

CVSS 3.1 · 4.9 Medium EPSS 1.0% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2018-20805

Invariant with $elemMatch

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2018-20804

Invariant failure in applyOps

A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Server v4.0 versions prior to 4.0.10 and MongoDB Server v3.6 versions prior to 3.6.13.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2018-20803

Infinite loop in aggregation expression

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2018-20802

Post-auth queries on compound index may crash mongod

A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prior to 4.0.3.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2018-13863

nodejs-bson: Regular expression denial of service in decimal128.js

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.

CVSS 3.0 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Mongodb

Products

Js-bson

CVE-2017-2665

rhscon-core: creates world readable file /etc/skyring/skyring.conf which leaks mongodb password for skyring database

The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb Redhat

Products

Mongodb Storage Console

CVE-2015-7882

Authentication bypass when using LDAP authentication in MongoDB Enterprise Server

Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.

CVSS 3.0 · 8.1 High EPSS 1.8% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2015-4411

rubygem-moped: Denial of Service with crafted ObjectId string (incomplete fix for CVE-2015-4410)

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

CVSS 3.1 · 7.5 High EPSS 6.4% KEV · Not listed

Vendors

Fedoraproject Mongodb

Products

Fedora Bson

CVE-2024-8305

MongoDB Server secondaries may crash due to forced index constraints

prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb

CVE-2024-8013

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongo Crypt V1.so Mongocryptd

CVE-2024-7553

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Mongodb

Products

Windows 10 1507 Windows 10 1511 Windows 10 1607 and 21 more