Filtered by vendor Parse Community Subscriptions
Filtered by product Parse Server Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-39309 1 Parse Community 1 Parse Server 2024-11-21 9.8 Critical
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
CVE-2024-47183 2 Parse Community, Parseplatform 2 Parse Server, Parse Server 2024-11-14 8.1 High
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.