PT-2021-10776

Name of the Vulnerable Software and Affected Versions gpac version 0.8.0 Description A memory leak in the senc Parse function in MP4Box allows attackers to cause a denial of service DoS via a crafted input. Recommendations For gpac version 0.8.0, at the moment, there is no information about a new...

PT-2021-4366

Name of the Vulnerable Software and Affected Versions llhttp versions prior to 2.1.4 llhttp versions prior to 6.0.6 Description The issue is related to the parse function in llhttp, which ignores chunk extensions when parsing the body of chunked requests. This can lead to HTTP Request Smuggling H...

PT-2021-10781

Name of the Vulnerable Software and Affected Versions gpac version 0.8.0 Description The issue is related to a memory leak in the sgpd parse entry function in MP4Box, which allows attackers to cause a denial of service DoS via a crafted input. Recommendations For gpac version 0.8.0, consider...

javaparser:parseFuzzer: Uncaught exception in com.github.javaparser.ast.expr.BinaryExpr.accept

Project: https://github.com/javaparser/javaparser.git Detailed Report: https://oss-fuzz.com/testcase?key=5530030613069824 Project: javaparser Fuzzing Engine: libFuzzer Fuzz Target: parseFuzzer Job Type: libfuzzerasanjavaparser Platform Id: linux Crash Type: Uncaught exception Crash Address: Crash...

PT-2021-23407

Name of the Vulnerable Software and Affected Versions Open5GS versions 1.0.0 through 2.3.3 Description The issue arises from the ogs fqdn parse function in Open5GS, which inappropriately trusts a client-supplied length value. This leads to a buffer overflow when an attacker sends a PFCP Session...

GO-2021-0113 Out-of-bounds read in golang.org/x/text/language

Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...

CVE-2021-0690

In ih264dmarkerrsliceskip of ih264dparsepslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9...

PT-2021-7944

Name of the Vulnerable Software and Affected Versions golang.org/x/text versions prior to 0.3.7 Description The issue is related to a denial-of-service attack that can occur due to an out-of-bounds read during BCP 47 language tag parsing. This happens because of mishandled index calculation. If...

LiveQuery publishes user session tokens in parse-server

Impact For regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery...

GHSA-7PR3-P5FM-8R9X LiveQuery publishes user session tokens in parse-server

Impact For regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the Parse.User class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

Session fixation

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109 LiveQuery publishes user session tokens

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

CVE-2021-41109

CVE-2021-41109 refers to a vulnerability in Parse Server where, before version 4.10.4, LiveQuery payloads leaked session tokens for users with a LiveQuery subscription on the Parse.User class. The root cause is that LiveQuery payloads included session tokens while regular queries did not. The adv...

CVE-2021-41109

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

PT-2021-23094 · Unknown · Parse Server

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.4 Description: The issue concerns the exposure of session tokens in LiveQuery payloads for users with a LiveQuery subscription on the Parse.User class. Normally, session tokens are removed from responses fo...

CVE-2021-41109: Exposure of Sensitive Information to an Unauthorized Actor

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular non-LiveQuery queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscriptio...

Parse Server 信息泄露漏洞

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server suffers from an information disclosure vulnerability that stems from the fact that for regular non-LiveQuery queries, session tokens are removed from the response, but not currentl...