← Back

Mongodb

mongodb

Vendor: Mongodb • 188 CVEs

CVEs (188)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-6494
2Fedoraproject
Mongodb
2Fedora
Mongodb
May 6, 2026
Oct 3, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.
CVE-2015-1609
2Fedoraproject
Mongodb
2Fedora
Mongodb
May 6, 2026
Mar 30, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
CVE-2014-3971
1Mongodb
1Mongodb
May 6, 2026
Dec 25, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authent...Show more
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.Show less
CVE-2012-6619
1Mongodb
1Mongodb
May 6, 2026
Mar 6, 2014
N/A· v4
N/A· v3
6.4 MEDIUM· v2
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column nam...Show more
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.Show less
CVE-2013-3969
1Mongodb
1Mongodb
Apr 29, 2026
Oct 1, 2013
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary...Show more
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.Show less
CVE-2013-1892
2Mongodb
Redhat
2Enterprise Mrg
Mongodb
Apr 29, 2026
Oct 1, 2013
N/A· v4
N/A· v3
6.0 MEDIUM· v2
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access an...Show more
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.Show less
CVE-2013-2132
3Canonical
MongodbOpensuse
3Mongodb
OpensuseUbuntu Linux
Apr 29, 2026
Aug 15, 2013
N/A· v4
N/A· v3
4.3 MEDIUM· v2
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to...Show more
bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."Show less
CVE-2013-4650
1Mongodb
1Mongodb
Apr 29, 2026
Jul 4, 2013
N/A· v4
N/A· v3
6.5 MEDIUM· v2
MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.