Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: MongoDB Server 3.4.22, 3.6.14, 4.0.11 Clear all filters
TI-2019-01949 CVE-2019-2389 · GHSA-vjcf-4g29-6hfr

Process termination via PID file manipulation

Priority LOW 24

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via Sys…

CVSS 3.1MEDIUM 5.3 Local Low privileges User interaction EPSS 0.00303 Published 2019-08-30 Partial fix · 4.0.11, 3.6.14 +1 CWE-732
TI-2019-01950 CVE-2019-2390 · GHSA-59q4-q97g-jqjq

Code execution on Windows via OpenSSL engine injection

Priority LOW 37

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user runnin…

CVSS 3.1HIGH 8.2 Local Low privileges User interaction EPSS 0.00932 Published 2019-08-30 Fixed in 4.0.11, 3.6.14 +1 CWE-94