Advisories · Technology

MongoDB Inc. MongoDB Server.

Every CVE that names MongoDB Inc. MongoDB Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-32037 CVE record

CVSS 6.5 Medium

User may trigger invariant when allowed to send commands directly to shards
- MongoDB Inc. MongoDB Server
- Denial of service
Not analysed yet 24 Nov 2021
CVE-2021-20333 CVE record

CVSS 5.3 Medium

Server log entry spoofing via newline injection
- MongoDB Inc. MongoDB Server
- Other injection
Not analysed yet 23 Jul 2021
CVE-2021-20326 CVE record

CVSS 6.5 Medium

Specially crafted query may result in a denial of service of mongod
- MongoDB Inc. MongoDB Server
- CWE-20
Not analysed yet 30 Apr 2021
CVE-2018-25004 CVE record

CVSS 4.9 Medium

Invariant failure when explaining a find with a UUID
- MongoDB Inc. MongoDB Server
- CWE-20
Not analysed yet 1 Mar 2021
CVE-2020-7929 CVE record

CVSS 6.5 Medium

Specially crafted regex query can cause DoS
- MongoDB Inc. MongoDB Server
- CWE-185
Not analysed yet 1 Mar 2021
CVE-2019-20925 CVE record

CVSS 7.5 High

Denial of service via malformed network packet
- MongoDB Inc. MongoDB Server
- CWE-839
Not analysed yet 24 Nov 2020
CVE-2018-20803 CVE record

CVSS 6.5 Medium

Infinite loop in aggregation expression
- MongoDB Inc. MongoDB Server
- Denial of service
Not analysed yet 23 Nov 2020
CVE-2020-7928 CVE record

CVSS 6.5 Medium

Improper neutralization of null byte leads to read overrun
- MongoDB Inc. MongoDB Server
- CWE-158
Not analysed yet 23 Nov 2020
CVE-2019-2393 CVE record

CVSS 6.5 Medium

Crash while joining collections with $lookup
- MongoDB Inc. MongoDB Server
- Memory corruption
Not analysed yet 23 Nov 2020
CVE-2019-20923 CVE record

CVSS 6.5 Medium

Crash while handling internal Javascript exception types
- MongoDB Inc. MongoDB Server
- CWE-749
Not analysed yet 23 Nov 2020
CVE-2019-20924 CVE record

CVSS 6.5 Medium

Invariant in IndexBoundsBuilder
- MongoDB Inc. MongoDB Server
- CWE-394
Not analysed yet 23 Nov 2020
CVE-2019-2392 CVE record

CVSS 6.5 Medium

$mod can result in undefined behavior
- MongoDB Inc. MongoDB Server
- Memory corruption
Not analysed yet 23 Nov 2020
CVE-2018-20805 CVE record

CVSS 6.5 Medium

Invariant with $elemMatch
- MongoDB Inc. MongoDB Server
- Denial of service
Not analysed yet 23 Nov 2020
CVE-2018-20802 CVE record

CVSS 6.5 Medium

Post-auth queries on compound index may crash mongod
- MongoDB Inc. MongoDB Server
- CWE-394
Not analysed yet 23 Nov 2020
CVE-2018-20804 CVE record

CVSS 6.5 Medium

Invariant failure in applyOps
- MongoDB Inc. MongoDB Server
- CWE-20
Not analysed yet 23 Nov 2020
CVE-2020-7926 CVE record

CVSS 6.5 Medium

Specific query can cause a DoS against MongoDB Server
- MongoDB Inc. MongoDB Server
- CWE-755
Not analysed yet 23 Nov 2020
CVE-2020-7925 CVE record

CVSS 7.5 High

Denial of Service when processing malformed Role names
- MongoDB Inc. MongoDB Server
- CWE-475
Not analysed yet 23 Nov 2020
CVE-2020-7923 CVE record

CVSS 6.5 Medium

Specific GeoQuery can cause DoS against MongoDB Server
- MongoDB Inc. MongoDB Server
- CWE-755
Not analysed yet 21 Aug 2020
CVE-2020-7921 CVE record

CVSS 4.6 Medium

Administrative action may disable enforcement of per-user IP whitelisting
- MongoDB Inc. MongoDB Server
- CWE-182
Not analysed yet 6 May 2020
CVE-2019-2389 CVE record

CVSS 5.3 Medium

Process termination via PID file manipulation
- MongoDB Inc. MongoDB Server
- Broken access control
Not analysed yet 30 Aug 2019
CVE-2019-2390 CVE record

CVSS 8.2 High

Code execution on Windows via OpenSSL engine injection
- MongoDB Inc. MongoDB Server
- Code injection
Not analysed yet 30 Aug 2019
CVE-2019-2386 CVE record

CVSS 7.1 High

Authorization session conflation
- MongoDB Inc. MongoDB Server
- Broken access control
Not analysed yet 6 Aug 2019