CVE-2022-39396: Improperly Controlled Modification of Object Prototype Attributes

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. An attacker can use this prototype pollution sink to trigger a...

CVE-2022-39891

Heap overflow vulnerability in parsepce function in libsavsaudio.so in Editor Lite prior to version 4.0.41.3 allows attacker to get information...

Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers

Impact Keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the requestKeywordDenylist option. Patches Improved keyword detection. Workarounds...

GHSA-XPRV-WVH7-QQQX Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers

Impact Keywords that are specified in the Parse Server option requestKeywordDenylist can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the requestKeywordDenylist option. Patches Improved keyword detection. Workarounds...

CVE-2022-39891

Heap overflow vulnerability in parsepce function in libsavsaudio.so in Editor Lite prior to version 4.0.41.3 allows attacker to get information...

PT-2022-25084 · Unknown · Libsavsaudio.So +1

Name of the Vulnerable Software and Affected Versions: Editor Lite versions prior to 4.0.41.3 Description: A heap overflow vulnerability exists in the parse pce function in libsavsaudio.so of Editor Lite. This issue allows an attacker to obtain information. Recommendations: For versions prior to...

PT-2022-26110

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 Description The issue allows keywords specified in the requestKeywordDenylist option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being...

Parse Server security vulnerability

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A security vulnerability exists in Parse Server 4.10.18 through versions prior to 5.3.1 on the 5.X branch, which stems from the fact that an attacker can use a prototype contamination receiver ...

Samsung Editor Lite buffer error vulnerability

SAMSUNG Editor Lite is a video editor from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Editor Lite versions prior to 4.0.41.3, which is caused by a heap overflow in the parsepce function in libsavsaudio.so, which can be exploited by an attacker to obtain...

Remote code execution via MongoDB BSON parser through prototype pollution

Impact An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. Patches Prevent prototype pollution in MongoDB database adapter. Workarounds Disable remote code execution through the MongoDB BSON parser. Collaborators Mikhail Shcherbako...

golang: go/parser: stack exhaustion in all Parse* functions

A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go source code, which contains deeply nested types or declarations, a panic can occur due to stack exhaustion. This issue allows an attacker to impact system availability...

kernel: buffer overflow in nft_set_desc_concat_parse()

A vulnerability was found in the Linux kernel's nftsetdescconcatparse function .This flaw allows an attacker to trigger a buffer overflow via nftsetdescconcatparse , causing a denial of service and possibly to run code...

kernel: buffer overflow in nft_set_desc_concat_parse()

A vulnerability was found in the Linux kernel's nftsetdescconcatparse function .This flaw allows an attacker to trigger a buffer overflow via nftsetdescconcatparse , causing a denial of service and possibly to run code...

PT-2025-37636

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a null pointer dereference issue in the hugetlbfs parse param function. This occurs when parsing mount parameters, specifically when an illegal parameter like...

PT-2022-36753 · Git +1 · Opensis

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a heap-buffer-overflow READ 1. The crash state involves functions such as par...

PT-2025-38428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in acpi ps parse aml following a failing invocation of acpi ds call control method. The issue occurs because a walk state pushed to the thread is freed on...

PT-2022-27179 · Picoc · Picoc

Name of the Vulnerable Software and Affected Versions: PicoC version 3.2.2 Description: A heap buffer overflow was discovered in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall, which can lead to a potential issue. Recommendations: For PicoC version 3.2....

PT-2022-24955 · Unknown +2 · Parse Server +2

Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 4.10.18 Parse Server versions prior to 5.3.1 on the 5.X branch Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An attacker can use a prototype...

Prototype Pollution

deep-parse-json is vulnerable to prototype pollution. The library improperly validates the incoming JSON keys, which allows a remote attacker to add new properties to an object through proto attribute...

PT-2022-36752 · Git +1 · Mongoose

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue was identified, potentially causing a crash. The crash occurred in the mg mqtt parse function, as indicated by the cras...