2407 matches found
Denial of Service
Overview Versions of parse-server prior to 3.4.1 are vulnerable to Denial of Service DoS. POST requests to /parse/classes/Audience or other volatile classes cause the server to respond with a 500 Internal Server Error for any subsequent POST requests. Recommendation Upgrade to version 3.4.1 or...
parse-server denial of service vulnerability
parse-server is an open source Backend-as-a-Service BaaS framework that is primarily used for application backend processing. A security vulnerability exists in parse-server versions prior to 3.4.1. An attacker can exploit this vulnerability to cause a denial of service...
Information Disclosure
parse-server is vulnerable to information disclosure. A remote attacker is able to enumerate existing accounts by analyzing the error messages from server responses...
Denial Of Service (DoS)
parse-server is vulnerable to denial of service DoS. The attack exists when a post request is made against a volatile class such as /parse/classes/Audience, returning 500 an internal server error for subsequent POST requests...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
Design/Logic Flaw
parse-server before 3.6.0 allows account enumeration...
Design/Logic Flaw
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
CVE-2019-1020013
CVE-2019-1020013 affects parse-server prior to 3.6.0, allowing unauthenticated users to enumerate existing accounts via error messages. The root cause is information disclosure during authentication/account linking flow, where specific errors reveal account existence (ParseError.ACCOUNT_ALREADY_L...
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
CVE-2019-1020013
parse-server before 3.6.0 allows account enumeration...
@peterpme/parse-server-mailgun (>=2.4.8, <=2.5.11), botbuilder-linebot-connector (>=1.0.0, <=1.0.14) +17 more potentially affected by CVE-2019-1020013 via parse-server (>=2.0.8, <=2.8.4)
parse-server NPM version =2.0.8, =2.4.8, =1.0.0, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =2.3.3, =2.4.1 and more Source cves: CVE-2019-1020013 Source advisory: MEND:CVE-2019-1020013...
CVE-2019-1020012
CVE-2019-1020012 affects parse-server prior to 3.4.1 and enables a Denial of Service after POSTing to a volatile class (e.g., /parse/classes/_Audience). Several sources confirm the vulnerability and patch: the public advisory notes that subsequent POST requests can yield a 500 Internal Server Err...
@peterpme/parse-server-mailgun (>=2.4.8, <=2.5.11), botbuilder-linebot-connector (>=1.0.0, <=1.0.14) +17 more potentially affected by CVE-2019-1020012 via parse-server (>=2.0.8, <=2.8.4)
parse-server NPM version =2.0.8, =2.4.8, =1.0.0, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =2.3.3, =2.4.1 and more Source cves: CVE-2019-1020012 Source advisory: MEND:CVE-2019-1020012...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
CVE-2019-1020012
parse-server before 3.4.1 allows DoS after any POST to a volatile class...
