parse-server vulnerabilities (npm)
118 vulnerabilities.
-
parse-servernpm Parse Server 9.0.0 Stored XSS via malformed Content-Type 2.1 Low -
parse-servernpm Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change 2.3 Low -
parse-servernpm Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist 2.1 Low -
parse-servernpm Parse Server: Denial of service via exponential-time processing of deeply nested query operators 8.7 High -
parse-servernpm Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL 6.9 Medium -
parse-servernpm Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied 5.9 Medium -
parse-servernpm Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist 2.1 Low -
parse-servernpm Parse Server: Server option routeAllowList is bypassable through batch sub-requests 6.9 Medium -
parse-servernpm Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers 6.9 Medium -
parse-servernpm Parse Server: Pre-authentication denial of service via client version header regex backtracking 8.7 High -
parse-servernpm Parse Server: MFA SMS one-time password accepted twice under concurrent login 2.1 Low -
parse-servernpm Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` 5.3 Medium -
parse-servernpm Parse Server has a login timing side-channel reveals user existence 6.3 Medium -
parse-servernpm Parse Server has a file upload Content-Type override via extension mismatch 2.1 Low -
parse-servernpm Parse Server: Streaming file download bypasses afterFind file trigger authorization 8.2 High -
parse-servernpm Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value 5.3 Medium -
parse-servernpm Parse Server: Session field immutability bypass via falsy-value guard 5.3 Medium -
parse-servernpm Parse Server: GraphQL complexity validator exponential fragment traversal DoS 8.2 High -
parse-servernpm Parse Server: Cloud function validator bypass via prototype chain traversal 9.1 Critical -
parse-servernpm Parse Server: GraphQL API endpoint ignores CORS origin restriction 5.3 Medium -
parse-servernpm Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers 8.2 High -
parse-servernpm Parse Server: MFA single-use token bypass via concurrent authData login requests 2.1 Low -
parse-servernpm Parse Server: Auth data exposed via verify password endpoint 8.2 High -
parse-servernpm Parse Server: Auth data exposed via /users/me endpoint 7.1 High -
parse-servernpm Parse Server: MFA recovery code single-use bypass via concurrent requests 2.1 Low -
parse-servernpm Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter 8.6 High -
parse-servernpm Parse Server: Denial of service via unindexed database query for unconfigured auth providers 8.7 High -
parse-servernpm Parse Server: Session update endpoint allows overwriting server-generated session fields 5.3 Medium -
parse-servernpm Parse Server: LiveQuery subscription query depth bypass 8.2 High -
parse-servernpm Parse Server: Query condition depth bypass via pre-validation transform pipeline 8.7 High -
parse-servernpm Parse Server: Protected field change detection oracle via LiveQuery watch parameter 6.3 Medium -
parse-servernpm Parse Server: LiveQuery bypasses CLP pointer permission enforcement 7.1 High -
parse-servernpm Parse Server: Auth provider validation bypass on login via partial authData 7.0 High -
parse-servernpm Parse Server: Email verification resend page leaks user existence 6.3 Medium -
parse-servernpm Parse Server leaks protected fields via LiveQuery afterEvent trigger 8.2 High -
parse-servernpm Parse Server affected by empty authData bypassing credential requirement on signup 6.9 Medium -
parse-servernpm Parse Server: LiveQuery subscription with invalid regular expression crashes server 5.9 Medium -
parse-servernpm Parse Server session creation endpoint allows overwriting server-generated session fields 4.3 Medium -
parse-servernpm Parse Server vulnerable to schema poisoning via prototype pollution in deep copy 5.3 Medium -
parse-servernpm Parse Server's Cloud function dispatch crashes server via prototype chain traversal 8.2 High -
parse-servernpm Parse Server has a password reset token single-use bypass via concurrent requests 2.3 Low -
parse-servernpm Parse Server crash via deeply nested query condition operators 8.7 High -
parse-servernpm Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries 8.3 High -
parse-servernpm Parse Server GraphQL WebSocket endpoint bypasses security middleware 6.9 Medium -
parse-servernpm Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint 6.3 Medium -
parse-servernpm Parse Server: Account takeover via operator injection in authentication data identifier 9.3 Critical -
parse-servernpm Parse Server OAuth2 adapter shares mutable state across providers via singleton instance 9.1 Critical -
parse-servernpm Parse Server has a SQL injection via query field name when using PostgreSQL 5.1 Medium -
parse-servernpm Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause 6.9 Medium -
parse-servernpm Parse Server has user enumeration via email verification endpoint 6.3 Medium - Show olderLoading…