https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:38:33 +0000 https://cve.radiocsirt.org/vuln/9akk108472a9037 <p>ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.</p> <p>ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.</p> https://cve.radiocsirt.org/vuln/9akk108472a9037 https://cve.radiocsirt.org/vuln/certfr-2021-avi-151 certfr-2021-avi-151 https://cve.radiocsirt.org/vuln/certfr-2021-avi-151 https://cve.radiocsirt.org/vuln/euvd-2026-169367 EUVD-2026-169367 https://cve.radiocsirt.org/vuln/euvd-2026-169367 https://cve.radiocsirt.org/vuln/fkie_cve-2021-20328 <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-20328 https://cve.radiocsirt.org/vuln/ghsa-rghw-6px2-fgwc <p><strong>Affected:</strong> Maven: org.mongodb:mongodb-driver, Maven: org.mongodb:mongodb-driver-sync, Maven: org.mongodb:mongo-java-driver, Maven: org.mongodb:mongodb-driver-legacy</p> <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> <p><strong>Affected:</strong> Maven: org.mongodb:mongodb-driver, Maven: org.mongodb:mongodb-driver-sync, Maven: org.mongodb:mongo-java-driver, Maven: org.mongodb:mongodb-driver-legacy</p> <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> https://cve.radiocsirt.org/vuln/ghsa-rghw-6px2-fgwc https://cve.radiocsirt.org/vuln/gsd-2021-20328 gsd-2021-20328 https://cve.radiocsirt.org/vuln/gsd-2021-20328 https://cve.radiocsirt.org/vuln/icsa-26-218-01 <p>ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.</p> <p>ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who successfully exploits these vulnerabilities could potentially access sensitive information, cause denial of service, or disrupt system availability.</p> https://cve.radiocsirt.org/vuln/icsa-26-218-01 https://cve.radiocsirt.org/vuln/rhsa-2021:0871 <p>mongo-java-driver: client-side field level encryption not verifying KMS host name</p> <p>mongo-java-driver: client-side field level encryption not verifying KMS host name</p> https://cve.radiocsirt.org/vuln/rhsa-2021:0871 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-20328 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mongo-java-driver, Ubuntu:18.04:LTS: mongo-java-driver, Ubuntu:20.04:LTS: mongo-java-driver, Ubuntu:22.04:LTS: mongo-java-driver, Ubuntu:24.04:LTS: mongo-java-driver, Ubuntu:25.10: mongo-java-driver, Ubuntu:26.04:LTS: mongo-java-driver</p> <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mongo-java-driver, Ubuntu:18.04:LTS: mongo-java-driver, Ubuntu:20.04:LTS: mongo-java-driver, Ubuntu:22.04:LTS: mongo-java-driver, Ubuntu:24.04:LTS: mongo-java-driver, Ubuntu:25.10: mongo-java-driver, Ubuntu:26.04:LTS: mongo-java-driver</p> <p>Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-20328