parse vulnerabilities (Bitnami)
136 vulnerabilities.
parseBitnamiParse Server: Protected field change detection oracle via LiveQuery watch parameter6.3 MediumparseBitnamiParse Server: LiveQuery bypasses CLP pointer permission enforcement7.1 HighparseBitnamiParse Server: Auth provider validation bypass on login via partial authData7.0 HighparseBitnamiParse Server: Email verification resend page leaks user existence6.3 MediumparseBitnamiParse Server leaks protected fields via LiveQuery afterEvent trigger8.2 HighparseBitnamiParse Server affected by empty authData bypassing credential requirement on signup6.9 MediumparseBitnamiParse Server: LiveQuery subscription with invalid regular expression crashes server5.9 MediumparseBitnamiParse Server session creation endpoint allows overwriting server-generated session fields4.3 MediumparseBitnamiParse Server vulnerable to schema poisoning via prototype pollution in deep copy5.3 MediumparseBitnamiParse Server's Cloud function dispatch crashes server via prototype chain traversal8.2 HighparseBitnamiParse Server has a password reset token single-use bypass via concurrent requests2.3 LowparseBitnamiParse Server crash via deeply nested query condition operators8.7 HighparseBitnamiParse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries8.3 HighparseBitnamiParse Server GraphQL WebSocket endpoint bypasses security middleware6.9 MediumparseBitnamiParse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint6.3 MediumparseBitnamiParse Server: Account takeover via operator injection in authentication data identifier9.3 CriticalparseBitnamiParse Server OAuth2 adapter shares mutable state across providers via singleton instance9.1 CriticalparseBitnamiParse Server has a SQL injection via query field name when using PostgreSQL5.1 MediumparseBitnamiParse Server has a protected fields bypass via LiveQuery subscription WHERE clause6.9 MediumparseBitnamiParse Server has user enumeration via email verification endpoint6.3 MediumparseBitnamiParse Server MFA recovery codes not consumed after use8.2 HighparseBitnamiParse Server has a protected fields bypass via dot-notation in query and sort8.7 HighparseBitnamiParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL9.3 CriticalparseBitnamiParse Server has Stored XSS via file upload of HTML-renderable file types6.3 MediumparseBitnamiParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL9.3 CriticalparseBitnamiParse Server has an LDAP injection via unsanitized user input in DN and group filter construction6.0 MediumparseBitnamiParse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes8.8 HighparseBitnamiParse Server has a rate limit bypass via batch request endpoint6.9 MediumparseBitnamiParse Server OAuth2 authentication adapter account takeover via identity spoofing7.6 HighparseBitnamiParse Server role escalation and CLP bypass via direct `_Join` table write10.0 CriticalparseBitnamiParse Server session token exfiltration via `redirectClassNameForKey` query parameter9.9 CriticalparseBitnamiParse Server has a protected fields bypass via logical query operators7.1 HighparseBitnamiParse Server is missing audience validation in Keycloak authentication adapter7.6 HighparseBitnamiParse Server has stored cross-site scripting (XSS) via SVG file upload8.3 HighparseBitnamiParse Server ha a bypass of class-level permissions in LiveQuery8.7 HighparseBitnamiParse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API8.7 HighparseBitnamiParse Server has a SQL injection via dot-notation field name in PostgreSQL9.3 CriticalparseBitnamiParse Server has a NoSQL injection via token type in password reset and email verification endpoints8.7 HighparseBitnamiParse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution8.8 HighparseBitnamiParse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement6.9 MediumparseBitnamiParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery8.2 HighparseBitnamiParse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled6.9 MediumparseBitnamiParse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization6.3 MediumparseBitnamiParse Server: `PagesRouter` path traversal allows reading files outside configured pages directory6.3 MediumparseBitnamiParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters9.3 CriticalparseBitnamiParse Server: Malformed `$regex` query leaks database error details in API response6.9 MediumparseBitnamiParse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user8.5 HighparseBitnamiParse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction6.9 MediumparseBitnamiParse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction8.6 HighparseBitnamiParse Server: Account takeover via JWT algorithm confusion in Google auth adapter9.3 Critical- Show moreLoading…