Authorization Bypass

parse-server is vulnerable to authorization bypass. The vulnerability exists in the GraphQL viewer where an authenticated user can bypass the read security restrictions, and all objects linked through relation, placed on his User object...

PT-2020-21570

Name of the Vulnerable Software and Affected Versions Parse SDK versions 2.9.1 Parse Server versions 3.9.0 Description The issue arises from the setPassword method, which stores a user's password in localStorage as raw text, making it accessible to anyone with access to the localStorage. This...

GHSA-236H-RQV8-8Q73 GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), sails-hook-parse-server (>=1.0.0, <=1.1.0) potentially affected by CVE-2020-15126 via parse-server (3.10.0)

parse-server NPM version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @bigegg/parse-server-schema-config =1.0.5, =1.0.0, =1.1.0 Source cves: CVE-2020-15126 Source advisory: OSV:GHSA-236H-RQV8-8Q73...

GraphQL: Security breach on Viewer query

Impact An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object. Patches This vulnerability has been patched in Parse Server 4.3.0. Workarounds No References See commit...

OSV-2020-1165 Global-buffer-overflow in parse_headers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14154 Crash type: Global-buffer-overflow READ 4 Crash state: parseheaders parsehttprequest fuzzparsehttprequest...

PT-2020-21675

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several function calls, including js parse source element, JS EvalInternal,...

PT-2020-22665

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several functions: vcf parse format, vcf parse, and view vcf. No informatio...

PT-2020-21740

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue is related to a global buffer overflow read error. It occurs during the parsing of HTTP request headers, specifically within the parse headers a...

PT-2020-21647

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read 8 crash has been reported. The crash involves the following functions: sas read8, sas7bdat parse column size subheader, and...

PT-2020-21766

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include the crash type being a Heap-buffer-overflow READ 4, and the crash stat...

PT-2020-21817

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the ihevcd parse slice data, ihevcd decode, and ihevcd cxa...

PT-2020-21803

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash occurs in the SampledFunction::SampledFunction function, which is called by...

PT-2020-21839

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash caused by a negative-size-param, as reported by OSS-Fuzz. The crash occurs in the functions fuzz tlv to string, fuzz parse...

PT-2020-22647

Name of the Vulnerable Software and Affected Versions RDKit affected versions not specified Description The issue is related to a crash caused by a container-overflow READ 8 error. The crash occurs in the yysmiles parse function, which is part of the smiles parse helper and smiles parse functions...

PT-2020-22638

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash involves the functions ihevcd mv pred, ihevcd get mv ctb, and ihevcd parse slice data...

PT-2020-22655

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash occurs in the Json::OurReader functions, specifically in readCommen...

PT-2020-22644

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN WRITE. The crash state involves functions such as vcf parse format, vcf parse, and vcf read. No information...

PT-2020-22624

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is reported, with a crash type of Heap-buffer-overflow READ 4. The crash state involves functions such as sas read4,...

PT-2020-21718

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Global-buffer-overflow READ 2. The crash state involves functions such as ssl sigalg, tls1 process...