https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 22:59:10 +0000 https://cve.radiocsirt.org/vuln/bit-parse-2022-41878 <p><strong>Affected:</strong> Bitnami: parse</p> <p>Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> <p><strong>Affected:</strong> Bitnami: parse</p> <p>Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> https://cve.radiocsirt.org/vuln/bit-parse-2022-41878 https://cve.radiocsirt.org/vuln/euvd-2026-233424 EUVD-2026-233424 https://cve.radiocsirt.org/vuln/euvd-2026-233424 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41878 <p>Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> <p>Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. This issue is fixed in versions 4.10.19, and 5.3.2. If upgrade is not possible, the following Workarounds may be applied: Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41878 https://cve.radiocsirt.org/vuln/ghsa-xprv-wvh7-qqqx <p><strong>Affected:</strong> npm: parse-server</p> <p>### Impact</p> <p>Keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option.</p> <p>### Patches</p> <p>Improved keyword detection.</p> <p>### Workarounds</p> <p>Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> <p>### Collaborators</p> <p>Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative</p> <p>### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx</p> <p><strong>Affected:</strong> npm: parse-server</p> <p>### Impact</p> <p>Keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option.</p> <p>### Patches</p> <p>Improved keyword detection.</p> <p>### Workarounds</p> <p>Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.</p> <p>### Collaborators</p> <p>Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative</p> <p>### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx</p> https://cve.radiocsirt.org/vuln/ghsa-xprv-wvh7-qqqx https://cve.radiocsirt.org/vuln/gsd-2022-41878 gsd-2022-41878 https://cve.radiocsirt.org/vuln/gsd-2022-41878