Snyk Security Database

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm via the Google authentication. An attacker can gain unauthorized access to any user account linked with Google authentication by forging a JWT token with alg set to "none". This is only exploitable if Google authentication is enabled.

fickling is an A static analyzer and interpreter for Python pickle data

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the is_likely_safe(), check_safety(), --check-safety, always_check_safety() and check_safety() interfaces. An attacker can execute arbitrary code, open network connections, create files, or establish backdoor listeners by crafting malicious pickle files that exploit the bypass in the safety checks.

org.webjars.npm:svelte is a package for building web applications.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the bind:innerText and bind:textContent bindings on contenteditable elements during server-side rendering. An attacker can execute arbitrary scripts in the context of the application by injecting malicious HTML as the initial value when untrusted data is rendered.