MongoDB vulnerabilities
383 CVEs and advisories name MongoDB as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-6376ejson shell parser in MongoDB Compass maybe bypassed
- CVE-2024-6375Missing authorization check may lead to shard key refinement
- CVE-2024-5629Out-of-bounds read in bson module of PyMongo
- CVE-2024-3374MongoDB Server (mongod) may crash when generating ftdc
- CVE-2024-3372MongoDB Server may have unexpected application behaviour due to invalid BSON
- CVE-2024-3371Insufficient validation of external input in Compass may enable MITM attacks
- CVE-2024-1351MongoDB Server may allow successful untrusted connection
- CVE-2023-0437MongoDB client C Driver may infinitely loop when validating certain BSON input data
- CVE-2023-0436Secret logging may occur in debug mode of Atlas Operator
- CVE-2021-32050Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
- CVE-2023-1409Certificate validation issue in MongoDB Server running on Windows or macOS
- CVE-2023-4009Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
- CVE-2023-0342MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive
- CVE-2022-48282Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
- CVE-2022-24272MongoDB Server (mongod) may crash in response to unexpected requests
- CVE-2021-32040Large aggregation pipelines with a specific stage can crash mongod under default configuration
- CVE-2021-32036Denial of Service and Data Integrity vulnerability in features command
- CVE-2021-32039MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
- CVE-2021-20330Specific replication command with malformed oplog entries can crash secondaries
- CVE-2021-32037User may trigger invariant when allowed to send commands directly to shards
- CVE-2021-20332MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application
- CVE-2021-20333Server log entry spoofing via newline injection
- CVE-2021-20329Specific cstrings input may not be properly validated in the Go Driver
- CVE-2021-20331MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application
- CVE-2021-20326Specially crafted query may result in a denial of service of mongod
- CVE-2020-7924Specific command line parameter might result in accepting invalid certificate
- CVE-2021-20334Local privilege escalation in MongoDB Compass for Windows
- CVE-2018-25004Invariant failure when explaining a find with a UUID
- CVE-2020-7929Specially crafted regex query can cause DoS
- CVE-2021-20328MongoDB Java driver client-side field level encryption not verifying KMS host name