Parse Platform parse-server information disclosure vulnerability

Versions prior to Parse Platform parse-server 8.6.107 and versions from 9.0.0 through 9.10.5-alpha.8 contain an information disclosure vulnerability. This vulnerability arises because object update responses return field storage values that are reverts triggered by the beforeSave trigger. Even...

Parse Platform Parse Server input validation error vulnerability

Versions prior to Parse Platform Parse Server 8.6.100 and versions from 9.0.0 through 9.10.4-alpha.3 contain an input validation error vulnerability. This vulnerability arises from the failure to reject writes to reserved internal field names within client objects; as a result, clients can store ...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

Parse Platform Parse Server information disclosure vulnerability

Versions prior to Parse Platform Parse Server 8.6.103 and versions from 9.0.0 through 9.10.5-alpha.4 contain an information disclosure vulnerability. This vulnerability arises because LiveQuery’s subscription hash fails to respect constraints surrounding the $or operator, including the Session...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...