MongoDB

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents.

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application proce…

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression.

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code.

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods.

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own.

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema.

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext,…