2134 matches found
CVE-2019-1020013
CVE-2019-1020013 affects parse-server prior to 3.6.0, allowing unauthenticated users to enumerate existing accounts via error messages. The root cause is information disclosure during authentication/account linking flow, where specific errors reveal account existence (ParseError.ACCOUNT_ALREADY_L...
@peterpme/parse-server-mailgun (>=2.4.8, <=2.5.11), botbuilder-linebot-connector (>=1.0.0, <=1.0.14) +17 more potentially affected by CVE-2019-1020012 via parse-server (>=2.0.8, <=2.8.4)
parse-server NPM version =2.0.8, =2.4.8, =1.0.0, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =2.3.3, =2.4.1 and more Source cves: CVE-2019-1020012 Source advisory: MEND:CVE-2019-1020012...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
CVE-2019-1020012
CVE-2019-1020012 affects parse-server prior to 3.4.1 and enables a Denial of Service after POSTing to a volatile class (e.g., /parse/classes/_Audience). Several sources confirm the vulnerability and patch: the public advisory notes that subsequent POST requests can yield a 500 Internal Server Err...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
CVE-2019-1020013: Generation of Error Message Containing Sensitive Information
parse-server before 3.6.0 allows account enumeration...
CVE-2019-1020012: Inconsistent Interpretation of HTTP Requests
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
Sensitive Data Exposure in parse-server
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...
GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server
Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...
PT-2019-11629
Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.6.0 Description: The issue allows for account enumeration. An attacker can guess ids and obtain information about linked accounts or email addresses. This occurs because ParseError.ACCOUNT ALREADY LINKED208 is...
GHSA-2479-QVV7-47QQ Parse Server before v3.4.1 vulnerable to Denial of Service
Impact If a POST request is made to /parse/classes/Audience or other volatile class, any subsuquent POST requests result in an internal server error 500. Patches Afflicted installations will also have to remove the offending collection from their database. Yes, patched in 3.4.1 Workarounds Yes,...
Parse Server before v3.4.1 vulnerable to Denial of Service
Impact If a POST request is made to /parse/classes/Audience or other volatile class, any subsuquent POST requests result in an internal server error 500. Patches Afflicted installations will also have to remove the offending collection from their database. Yes, patched in 3.4.1 Workarounds Yes,...
PT-2019-11628
Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.4.1 Description: The issue allows for a denial of service DoS after any POST request to a volatile class. If a POST request is made to a volatile class, such as "/parse/classes/ Audience", any subsequent POST...
