CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-3085 – MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revoked
https://notcve.org/view.php?id=CVE-2025-3085
01 Apr 2025 — A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 version... • https://jira.mongodb.org/browse/SERVER-95445 • CWE-299: Improper Check for Certificate Revocation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-3084 – MongoDB Server may crash due to improper validation of explain command
https://notcve.org/view.php?id=CVE-2025-3084
01 Apr 2025 — When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4 • https://jira.mongodb.org/browse/SERVER-103153 • CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 3.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-3082 – User may override a view's collation and gain unauthorized access to underlying data
https://notcve.org/view.php?id=CVE-2025-3082
01 Apr 2025 — A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4. • https://jira.mongodb.org/browse/SERVER-103151 • CWE-284: Improper Access Control •
CVSS: 8.4EPSS: 0%CPEs: 3EXPL: 0CVE-2025-0755 – MongoDB C Driver bson library may be susceptible to buffer overflow
https://notcve.org/view.php?id=CVE-2025-0755
18 Mar 2025 — The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16 • https://jira.mongodb.org/browse/SERVER-94461 • CWE-122: Heap-based Buffer Overflow •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-10921 – Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
https://notcve.org/view.php?id=CVE-2024-10921
14 Nov 2024 — An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2. • https://jira.mongodb.org/browse/SERVER-96419 • CWE-158: Improper Neutralization of Null Byte or NUL Character •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8305 – MongoDB Server secondaries may crash due to forced index constraints
https://notcve.org/view.php?id=CVE-2024-8305
21 Oct 2024 — prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4 • https://jira.mongodb.org/browse/SERVER-92382 • CWE-1288: Improper Validation of Consistency within Input •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-6384 – Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
https://notcve.org/view.php?id=CVE-2024-6384
13 Aug 2024 — "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3 • https://jira.mongodb.org/browse/SERVER-93516 • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-7553 – Accessing Untrusted Directory May Allow Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-7553
07 Aug 2024 — Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and ... • https://jira.mongodb.org/browse/CDRIVER-5650 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-3372 – MongoDB Server may have unexpected application behaviour due to invalid BSON
https://notcve.org/view.php?id=CVE-2024-3372
14 May 2024 — Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25. Una validación inadecuada de cierta entrada de metadatos puede provocar que el servidor no serialice correctam... • https://jira.mongodb.org/browse/SERVER-85263 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1351 – MongoDB Server may allow successful untrusted connection
https://notcve.org/view.php?id=CVE-2024-1351
07 Mar 2024 — Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including... • https://jira.mongodb.org/browse/SERVER-72839 • CWE-295: Improper Certificate Validation •