Total 149 security vulnerabilities recorded for mongodb software and firmware.
Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These c...
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a...
An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard....
Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is ...
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue...
Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go ...
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by a...
A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects MongoDB Server v4.4 versions prior t...
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping a...
A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges o...
A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This is...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue aff...
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS...
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerabi...
For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turned on for their MongoDB process...
An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to i...
Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. Th...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathemati...
A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue ...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. Th...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overf...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the Ind...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exc...
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This i...