CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1755 – MongoDB Compass may be susceptible to local privilege escalation in Windows
https://notcve.org/view.php?id=CVE-2025-1755
27 Feb 2025 — MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1 • https://jira.mongodb.org/browse/COMPASS-9058 • CWE-426: Untrusted Search Path •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1693 – MongoDB Shell may be susceptible to control character Injection via shell output
https://notcve.org/view.php?id=CVE-2025-1693
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. This is... • https://jira.mongodb.org/browse/MONGOSH-2026 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1692 – MongoDB Shell may be susceptible to control character injection via pasting
https://notcve.org/view.php?id=CVE-2025-1692
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9 • https://jira.mongodb.org/browse/MONGOSH-2025 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1691 – MongoDB Shell may be susceptible to Control Character Injection via autocomplete
https://notcve.org/view.php?id=CVE-2025-1691
27 Feb 2025 — The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or... • https://jira.mongodb.org/browse/MONGOSH-2024 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-10921 – Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
https://notcve.org/view.php?id=CVE-2024-10921
14 Nov 2024 — An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2. • https://jira.mongodb.org/browse/SERVER-96419 • CWE-158: Improper Neutralization of Null Byte or NUL Character •
CVSS: 2.2EPSS: 0%CPEs: 7EXPL: 0CVE-2024-8013 – CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
https://notcve.org/view.php?id=CVE-2024-8013
28 Oct 2024 — A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 ve... • https://jira.mongodb.org/browse/SERVER-96254 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8305 – MongoDB Server secondaries may crash due to forced index constraints
https://notcve.org/view.php?id=CVE-2024-8305
21 Oct 2024 — prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior to 6.0.17, MongoDB Server v7.0 versions prior to 7.0.13 and MongoDB Server v7.3 versions prior to 7.3.4 • https://jira.mongodb.org/browse/SERVER-92382 • CWE-1288: Improper Validation of Consistency within Input •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8654 – MongoDB Server may access non-initialized region of memory leading to unexpected behaviour
https://notcve.org/view.php?id=CVE-2024-8654
10 Sep 2024 — MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3. MongoDB Server puede acceder a una región de memoria no inicializada, lo que genera un comportamiento inesperado cuando se invocan argumentos cero en la etapa de agregación interna. Este problema afecta a MongoDB Server v6.0 versión 6.0.3. • https://jira.mongodb.org/browse/SERVER-71477 • CWE-908: Use of Uninitialized Resource •
CVSS: 6.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8207 – MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths
https://notcve.org/view.php?id=CVE-2024-8207
27 Aug 2024 — In certain highly specific configurations of the host system and MongoDB server binary installation on Linux Operating Systems, it may be possible for a unintended actor with host-level access to cause the MongoDB Server binary to load unintended actor-controlled shared libraries when the server binary is started, potentially resulting in the unintended actor gaining full control over the MongoDB server process. This issue affects MongoDB Server v5.0 versions prior to 5.0.14 and MongoDB Server v6.0 versions... • https://jira.mongodb.org/browse/SERVER-69507 • CWE-114: Process Control •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-6384 – Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
https://notcve.org/view.php?id=CVE-2024-6384
13 Aug 2024 — "Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3 • https://jira.mongodb.org/browse/SERVER-93516 • CWE-285: Improper Authorization •