CVE-2020-5251: Improper Authorization

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...

PT-2020-18345 · Parse · Parse Server

Name of the Vulnerable Software and Affected Versions: parser-server versions prior to 4.1.0 Description: The issue allows fetching all user objects by utilizing regex in the NoSQL query, specifically targeting the sessionToken. This can be achieved through the API endpoint "/parse/users/me" by...

PT-2020-14206

Name of the Vulnerable Software and Affected Versions parser-server versions 3.5.0 through 4.2.x Description The issue allows an authenticated user using the viewer GraphQL query to bypass all read security on their User object and on objects linked via relation or Pointer on their User object...