parse vulnerabilities (Bitnami)
136 vulnerabilities.
-
parseBitnami Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB 8.8 High -
parseBitnami Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes 6.3 Medium -
parseBitnami Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 9.1 Critical -
parseBitnami Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login 2.1 Low -
parseBitnami Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions 6.0 Medium -
parseBitnami Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass 2.3 Low -
parseBitnami Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update 6.9 Medium -
parseBitnami Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error 8.2 High -
parseBitnami Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference 8.3 High -
parseBitnami Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query 5.3 Medium -
parseBitnami Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries 6.3 Medium -
parseBitnami Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL 8.2 High -
parseBitnami Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors 6.3 Medium -
parseBitnami Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity 7.4 High -
parseBitnami Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery 7.1 High -
parseBitnami Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection 8.7 High -
parseBitnami Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password 9.1 Critical -
parseBitnami Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages 6.3 Medium -
parseBitnami Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages 6.3 Medium -
parseBitnami Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion 6.9 Medium -
parseBitnami Parse Server 9.0.0 Stored XSS via malformed Content-Type 2.1 Low -
parseBitnami Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change 2.3 Low -
parseBitnami Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist 2.1 Low -
parseBitnami Parse Server: Denial of service via exponential-time processing of deeply nested query operators 8.7 High -
parseBitnami Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL 6.9 Medium -
parseBitnami Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied 5.9 Medium -
parseBitnami Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist 2.1 Low -
parseBitnami Parse Server: Server option routeAllowList is bypassable through batch sub-requests 6.9 Medium -
parseBitnami Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers 6.9 Medium -
parseBitnami Parse Server: Pre-authentication denial of service via client version header regex backtracking 8.7 High -
parseBitnami Parse Server: MFA SMS one-time password accepted twice under concurrent login 2.1 Low -
parseBitnami Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` 5.3 Medium -
parseBitnami Parse Server has a login timing side-channel reveals user existence 6.3 Medium -
parseBitnami Parse Server has a file upload Content-Type override via extension mismatch 2.1 Low -
parseBitnami Parse Server: Streaming file download bypasses afterFind file trigger authorization 8.2 High -
parseBitnami Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value 5.3 Medium -
parseBitnami Parse Server: Session field immutability bypass via falsy-value guard 5.3 Medium -
parseBitnami Parse Server: GraphQL complexity validator exponential fragment traversal DoS 8.2 High -
parseBitnami Parse Server: Cloud function validator bypass via prototype chain traversal 9.1 Critical -
parseBitnami Parse Server: GraphQL API endpoint ignores CORS origin restriction 5.3 Medium -
parseBitnami Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers 8.2 High -
parseBitnami Parse Server: MFA single-use token bypass via concurrent authData login requests 2.1 Low -
parseBitnami Parse Server: Auth data exposed via verify password endpoint 8.2 High -
parseBitnami Parse Server: Auth data exposed via /users/me endpoint 7.1 High -
parseBitnami Parse Server: MFA recovery code single-use bypass via concurrent requests 2.1 Low -
parseBitnami Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter 8.6 High -
parseBitnami Parse Server: Denial of service via unindexed database query for unconfigured auth providers 8.7 High -
parseBitnami Parse Server: Session update endpoint allows overwriting server-generated session fields 5.3 Medium -
parseBitnami Parse Server: LiveQuery subscription query depth bypass 8.2 High -
parseBitnami Parse Server: Query condition depth bypass via pre-validation transform pipeline 8.7 High - Show olderLoading…