ots:ots-fuzzer: Use-of-uninitialized-value in ots::OpenTypeGVAR::Parse

Project: https://github.com/khaledhosny/ots.git Detailed Report: https://oss-fuzz.com/testcase?key=5742168799707136 Project: ots Fuzzing Engine: libFuzzer Fuzz Target: ots-fuzzer Job Type: libfuzzermsanots Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Information Disclosure

parse is vulnerable to information disclosure. The setPassword function stores the user's password in localStorage as raw text, allowing a user to access the localStorage and obtain the password...

GHSA-WVH7-5P38-2QFC Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @adncorp/parse-server (>=2.0.0, <=2.10.4) +24 more potentially affected by unknown CVE via parse (>=2.0.1, <=2.8.0)

parse NPM version =2.0.1, =3.10.1, =2.0.0, =0.0.7, =1.0.5, =4.3.0-fast-roles, =4.3.0, =1.0.9, =1.0.0, =3.1.1, =3.10.0, =3.1.3, =3.1.6 - nex-parse-server 4.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WVH7-5P38-2QFC...

Storing Password in Local Storage

The setPassword method http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.htmlsetPassword stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the...

Authorization Bypass

parse-server is vulnerable to authorization bypass. The vulnerability exists in the GraphQL viewer where an authenticated user can bypass the read security restrictions, and all objects linked through relation, placed on his User object...

PT-2020-21570

Name of the Vulnerable Software and Affected Versions Parse SDK versions 2.9.1 Parse Server versions 3.9.0 Description The issue arises from the setPassword method, which stores a user's password in localStorage as raw text, making it accessible to anyone with access to the localStorage. This...

GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), sails-hook-parse-server (>=1.0.0, <=1.1.0) potentially affected by CVE-2020-15126 via parse-server (3.10.0)

parse-server NPM version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @bigegg/parse-server-schema-config =1.0.5, =1.0.0, =1.1.0 Source cves: CVE-2020-15126 Source advisory: OSV:GHSA-236H-RQV8-8Q73...

GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

OSV-2020-1165 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14154 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

PT-2020-22665

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several functions: vcf parse format, vcf parse, and view vcf. No informatio...

PT-2020-21675

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several function calls, including js parse source element, JS EvalInternal,...

PT-2020-21647

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read 8 crash has been reported. The crash involves the following functions: sas read8, sas7bdat parse column size subheader, and...

PT-2020-21726

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the following functions: dex parse debug item, parse dex class method, and parse...

PT-2020-21696

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash occurs in the following functions: dex parse debug item, parse dex class method, and parse...

PT-2020-21689

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the fuzz tlv to string and fuzz parse tlv...

PT-2020-21739

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions readstat convert, sas7bcat parse value labels, and sas7bcat parse...

PT-2020-21742

Name of the Vulnerable Software and Affected Versions Oniguruma affected versions not specified Description The issue is related to a crash caused by the use of an uninitialized value. Technical details about the crash include the gbNUMBER mbc enc len function, onigenc mb4 code to mbc function, a...

PT-2020-21740

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a global buffer overflow read error. It occurs during the parsing of HTTP request headers, specifically within the parse headers a...