WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product mongodb✕
Overview 206 matches · 9 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
206matches 9in Waratek scope4.4% 0protected0.0% 1exploited0.5% 1CISA KEV0.5% 4public PoC1.9% 1EPSS ≥ 0.50.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 0.5% No exploit published 8 3.9% Outside Waratek scope 1 0.5% Not applicable 196 95.1% Withdrawn CVE 0 0.0%
Critical 10 4.9% High 110 53.4% Medium 80 38.8% Low 6 2.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 206 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 0.5% Working exploit published 2 1.0% Proof of concept only 1 0.5% Forecast only 0 0.0% No public exploit 202 98.1%
split by peak 118 / year
Not applicable: 196Outside Waratek scope: 1No exploit published: 8Mitigation candidate: 1 Low: 6Medium: 80High: 110Critical: 10 not blocked: 206 No public exploit: 202Proof of concept only: 1Working exploit published: 2Exploited: 1
20134 Not applicable4 Medium4 not blocked4 Working exploit published2 No public exploit2 20142 Not applicable2 Medium2 not blocked2 No public exploit2 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20162 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20174 Not applicable4 Critical1 High2 Medium1 not blocked4 No public exploit4 20182 Not applicable2 High2 not blocked2 No public exploit2 20195 Not applicable5 High4 Medium1 not blocked5 No public exploit5 202018 No exploit published3 Not applicable15 High4 Medium14 not blocked18 No public exploit18 20218 No exploit published1 Not applicable7 Medium8 not blocked8 No public exploit8 20225 Mitigation candidate1 Not applicable4 Critical1 High2 Medium2 not blocked5 Proof of concept only1 No public exploit4 20231 Not applicable1 High1 not blocked1 No public exploit1 202410 Outside Waratek scope1 Not applicable9 Critical2 High3 Medium5 not blocked10 No public exploit10 202526 No exploit published1 Not applicable25 Critical1 High11 Medium11 Low3 not blocked26 Exploited1 No public exploit25 2026118 No exploit published3 Not applicable115 Critical5 High80 Medium30 Low3 not blocked118 No public exploit118
2014201620182020202220242026
206 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2014-3971 Medium 2014-12-25 Not applicable No public exploit The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.
CVE-2012-6619 Medium 2014-03-06 Not applicable No public exploit The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert command, which triggers a buffer over-read.
CVE-2013-3969 Medium 2013-10-01 Not applicable Working exploit published The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
CVE-2013-1892 Medium 2013-10-01 Not applicable Working exploit published MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
CVE-2013-2132 Medium 2013-08-15 Not applicable No public exploit bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
CVE-2013-4650 Medium 2013-07-04 Not applicable No public exploit MongoDB 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allows remote authenticated users to obtain internal system privileges by leveraging a username of __system in an arbitrary database.
‹ prev page 3 of 3 next ›