CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7610
https://notcve.org/view.php?id=CVE-2020-7610
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type. Todas las versiones de bson anteriores a 1.1.4, son vulnerables a la Deserialización de Datos No Confiables. El paquete ignorará un valor desconocido para un _bsotype de objeto, conllevando a casos donde un objeto es serializado como un documento en lugar del tipo BSON previsto. • https://snyk.io/vuln/SNYK-JS-BSON-561052 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 3%CPEs: 3EXPL: 2CVE-2015-4411
https://notcve.org/view.php?id=CVE-2015-4411
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410. El método Moped::BSON::ObjecId.legal? en mongodb/bson-ruby, versiones anteriores a 3.0.4, como es usado en rubygem-moped, permite a atacantes remotos causar una denegación de servicio (consumo de recursos de worker) por medio de una cadena diseñada. • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.html http://www.openwall.com/lists/oss-security/2015/06/06/3 http://www.securityfocus.com/bid/75045 https://bugzilla.redhat.com/show_bug.cgi?id=1229706 https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999 https://github.com/mongodb/bson-ruby/commit/fef6f75413511d653c76bf924a932374a183a24f#diff-8c8558c185bbb548ccb5a6d6ac4bfee5R191 https:// • CWE-400: Uncontrolled Resource Consumption •