Vulnerabilities

 4 via 4 paths

Dependencies

 391

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 3
  • 1
Status
  • 4
  • 0
  • 0

high severity
new

Uncaught Exception

  • Vulnerable module: body-parser
  • Introduced through: body-parser@2.3.0

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › body-parser@2.3.0
    Remediation: Upgrade to body-parser@2.4.0.

Overview

Affected versions of this package are vulnerable to Uncaught Exception via the read function in lib/read.js when processing a compressed request body that contains trailing bytes. An attacker can send a compressed body with trailing data, causing the decompression stream to emit an error on an already-finished stream with no error listener attached, which crashes the Node.js process.

Remediation

Upgrade body-parser to version 1.20.9, 2.4.0 or higher.

References

Uncaught Exception vulnerability report

high severity

Improper Authorization

  • Vulnerable module: http-cache-semantics
  • Introduced through: package-json@7.0.0

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › package-json@7.0.0 › got@11.8.6 › cacheable-request@7.0.4 › http-cache-semantics@4.3.0

Overview

Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses belonging to other users, including Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Remediation

There is no fixed version for http-cache-semantics.

References

Improper Authorization vulnerability report

high severity

Origin Validation Error

  • Vulnerable module: http-cache-semantics
  • Introduced through: package-json@7.0.0

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › package-json@7.0.0 › got@11.8.6 › cacheable-request@7.0.4 › http-cache-semantics@4.3.0

Overview

Affected versions of this package are vulnerable to Origin Validation Error via the _varyMatches() function, which fails to properly handle Vary: * (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The Vary: * directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.

Remediation

There is no fixed version for http-cache-semantics.

References

Origin Validation Error vulnerability report

medium severity
new

Memory Allocation with Excessive Size Value

  • Vulnerable module: js-beautify
  • Introduced through: js-beautify@1.15.4

Detailed paths

  • Introduced through: parse-dashboard@parse-community/parse-dashboard › js-beautify@1.15.4

Overview

js-beautify is a reformat and re-indent bookmarklets, ugly JavaScript, unpack scripts packed by Dean Edward’s popular packer, as well as partly deobfuscate scripts processed by the npm package "javascript-obfuscator".

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via an unknown function, allowing a remote attacker to trigger uncontrolled memory allocation by sending a manipulated input, resulting in resource exhaustion.

Remediation

There is no fixed version for js-beautify.

References

Memory Allocation with Excessive Size Value vulnerability report