Advisories · Technology
parse-community parse-server.
Every CVE that names parse-community parse-server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
- parse-community parse-server
- Information disclosure
- CVSS 6.0 Medium
Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
- parse-community parse-server
- Prototype pollution
- CVSS 6.3 Medium
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
- parse-community parse-server
- CWE-20
- CVSS 8.2 High
Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
- parse-community parse-server
- CWE-248
- CVSS 2.3 Low
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
- parse-community parse-server
- Broken access control
- CVSS 2.3 Low
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
- parse-community parse-server
- Information disclosure
- CVSS 6.3 Medium
Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
- parse-community parse-server
- Broken access control
- CVSS 2.3 Low
Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
- parse-community parse-server
- Information disclosure
- CVSS 6.0 Medium
Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
- parse-community parse-server
- Prototype pollution
- CVSS 2.3 Low
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
- parse-community parse-server
- CWE-754
- CVSS 2.3 Low
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- parse-community parse-server
- Information disclosure
- CVSS 5.3 Medium
Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
- parse-community parse-server
- Other injection
- CVSS 8.8 High
Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- parse-community parse-server
- Broken access control
- CVSS 6.3 Medium
Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
- parse-community parse-server
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
- parse-community parse-server
- Authentication bypass
- CVSS 2.1 Low
Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
- parse-community parse-server
- Privilege escalation
- CVSS 6.0 Medium
Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
- parse-community parse-server
- Information disclosure
- CVSS 2.3 Low
Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
- parse-community parse-server
- Broken access control
- CVSS 6.9 Medium
Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
- parse-community parse-server
- Broken access control
- CVSS 8.2 High
Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
- parse-community parse-server
- CWE-248
- CVSS 8.3 High
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
- parse-community parse-server
- Race condition
- CVSS 5.3 Medium
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query
- parse-community parse-server
- Broken access control
- CVSS 6.3 Medium
Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
- parse-community parse-server
- Broken access control
- CVSS 8.2 High
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
- parse-community parse-server
- CWE-248
- CVSS 6.3 Medium
Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
- parse-community parse-server
- Information disclosure
- CVSS 7.4 High
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
- parse-community parse-server
- Authentication bypass
- CVSS 7.1 High
Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery
- parse-community parse-server
- Information disclosure
- CVSS 8.7 High
Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection
- parse-community parse-server
- Other injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- parse-community parse-server
- Authentication bypass
- CVSS 6.3 Medium
Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- parse-community parse-server
- Information disclosure
- CVSS 6.3 Medium
Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages
- parse-community parse-server
- Information disclosure
- CVSS 6.9 Medium
Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion
- parse-community parse-server
- Information disclosure
- CVSS 6.9 Medium
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
- parse-community parse-server
- Code injection
- Privilege escalation