Denial Of Service (DoS)

parse-server is vulnerable to denial of service DoS. The attack exists when a post request is made against a volatile class such as /parse/classes/Audience, returning 500 an internal server error for subsequent POST requests...

CVE-2019-1020012

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020012

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

Design/Logic Flaw

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

Design/Logic Flaw

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020013

CVE-2019-1020013 affects parse-server prior to 3.6.0, allowing unauthenticated users to enumerate existing accounts via error messages. The root cause is information disclosure during authentication/account linking flow, where specific errors reveal account existence (ParseError.ACCOUNT_ALREADY_L...

CVE-2019-1020013

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020012

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

CVE-2019-1020012

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

CVE-2019-1020012

CVE-2019-1020012 affects parse-server prior to 3.4.1 and enables a Denial of Service after POSTing to a volatile class (e.g., /parse/classes/_Audience). Several sources confirm the vulnerability and patch: the public advisory notes that subsequent POST requests can yield a 500 Internal Server Err...

CVE-2019-1020013: Generation of Error Message Containing Sensitive Information

parse-server before 3.6.0 allows account enumeration...

CVE-2019-1020012: Inconsistent Interpretation of HTTP Requests

parse-server before 3.4.1 allows DoS after any POST to a volatile class...

Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...

GHSA-8W3J-G983-8JH5 Sensitive Data Exposure in parse-server

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking. ParseError.ACCOUNTALREADYLINKED208 was thrown BEFORE the AuthController checks the password and throws a ParseError.SESSIONMISSING206 for Insufficient auth. An attacker can guess ids and get...

PT-2019-11629

Name of the Vulnerable Software and Affected Versions: parse-server versions prior to 3.6.0 Description: The issue allows for account enumeration. An attacker can guess ids and obtain information about linked accounts or email addresses. This occurs because ParseError.ACCOUNT ALREADY LINKED208 is...

GHSA-2479-QVV7-47QQ Parse Server before v3.4.1 vulnerable to Denial of Service

Impact If a POST request is made to /parse/classes/Audience or other volatile class, any subsuquent POST requests result in an internal server error 500. Patches Afflicted installations will also have to remove the offending collection from their database. Yes, patched in 3.4.1 Workarounds Yes,...

Parse Server before v3.4.1 vulnerable to Denial of Service

Impact If a POST request is made to /parse/classes/Audience or other volatile class, any subsuquent POST requests result in an internal server error 500. Patches Afflicted installations will also have to remove the offending collection from their database. Yes, patched in 3.4.1 Workarounds Yes,...