CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-7553 – Accessing Untrusted Directory May Allow Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-7553
07 Aug 2024 — Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and ... • https://jira.mongodb.org/browse/CDRIVER-5650 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0437 – MongoDB client C Driver may infinitely loop when validating certain BSON input data
https://notcve.org/view.php?id=CVE-2023-0437
12 Jan 2024 — When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0. Al llamar a bson_utf8_validate en algunas entradas puede ocurrir un bucle con una condición de salida que no se puede alcanzar, es decir, un bucle infinito. Este problema afecta a All MongoDB C Driver anteriores a la versión 1.25.0. When calling bson_utf8_validate on some inputs a loop with an exit con... • https://jira.mongodb.org/browse/CDRIVER-4747 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-32050 – Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
https://notcve.org/view.php?id=CVE-2021-32050
29 Aug 2023 — Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects ... • https://jira.mongodb.org/browse/CDRIVER-3797 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-48282 – Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
https://notcve.org/view.php?id=CVE-2022-48282
21 Feb 2023 — Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validati... • https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0 • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20331 – MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application
https://notcve.org/view.php?id=CVE-2021-20331
13 May 2021 — Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables ... • https://jira.mongodb.org/browse/CSHARP-3521 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-12135 – Ubuntu Security Notice USN-4450-1
https://notcve.org/view.php?id=CVE-2020-12135
24 Apr 2020 — bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input. bson en versiones anteriores a la 0.8 usa incorrectamente int en lugar de size_t para muchas variables, parámetros y valores de retorno. En particular, el parámetro bson_ensure_space () bytesNeeded podría tener un desbordamiento de enteros a través de una entrada bson constru... • https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1872560 • CWE-190: Integer Overflow or Wraparound •