RSS   Vulnerabilities for 'Parse-server'   RSS

2021-09-30
 
CVE-2021-41109

CWE-200
 
 
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.

 
2021-09-02
 
CVE-2021-39187

CWE-755
 
 
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.

 
2020-12-30
 
CVE-2020-26288

CWE-312
 
 
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.

 
2020-03-04
 
CVE-2020-5251

CWE-863
 
 
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.

 
2019-07-29
 
CVE-2019-1020013

CWE-287
 
 
parse-server before 3.6.0 allows account enumeration.

 
 
CVE-2019-1020012

CWE-444
 
 
parse-server before 3.4.1 allows DoS after any POST to a volatile class.

 

 >>> Vendor: Parseplatform 2 Products
Parse-server
Parse server

Copyright 2024, cxsecurity.com

 

Back to Top