GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows

Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

bson_validate may skip validation when processing certain inputs

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption…

Connection-option injection via unescaped settings in the canonical MongoDB URL builder

Heap memory out of bounds read and crash in C Driver legacy GridFS file reader