CVE Vulnerability Catalog

A vulnerability in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.

A vulnerability in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.

A vulnerability in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.

A vulnerability in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.

An authenticated user with limited database-scoped privileges can modify diagnostic logging settings affecting the entire server, not just the intended database. This could allow suppression of server-wide diagnostic logging, potentially hiding unauthorized activity or causing excessive log volume that degrades operational monitoring.

An authenticated user with read privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query filter, resulting in a denial of service.

An authenticated user with write privileges can cause a use-after-free condition through concurrent operations on a collection with a certain validator type, leading to a server crash and denial of service.

An authenticated user with read-level privileges can cause the MongoDB server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index, resulting in a denial of service affecting connected clients and in-flight operations.

An authenticated user with a limited database-scoped role can perform actions against protected system collections that should require more specific privileges, potentially exposing collection metadata and, in certain configurations, allowing unauthorized modification of system collection data.

An authenticated user with specific non-default privileges can perform data-definition operations, such as dropping or modifying collections, on collections they do not have permission to manipulate, due to an inconsistency in target collection determination between authorization check and actual operation.

An authenticated user with write access can cause the MongoDB server process to terminate unexpectedly through handling of certain query predicates against time-series collections with a metaField, resulting in a denial of service.

CVAT is an open source interactive video and image annotation tool. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request with inconsistent task and job IDs, blocking automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0.

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.

Coturn before version 4.13.1 has a vulnerability in good_peer_addr() that does not canonicalize IPv4-compatible, 6to4, and NAT64 (64:ff9b::/96) address forms. This allows an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route.

Nmap up to and including version 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet with a zero-length TCP option. The malformed packet forces Packet:parse_options() in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition and application crash.

Cap version 0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.

Microsoft OneDrive contains an improper link resolution before file access ('link following') vulnerability that allows an authorized attacker to elevate privileges locally.

Turso CLI before version 1.0.26 persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants full Turso platform access scoped to the user's organizations.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.