Mikhail Shcherbakov

**Name of the Vulnerable Software and Affected Versions** parse-server versions prior to 6.5.0 parse-server versions prior to 7.0.0-alpha.20 **Description** This issue allows SQL injection when parse-server is configured to use the PostgreSQL database. A remote attacker could send specially-crafted SQL statements to view, add, modify or delete information in the back-end database. **Recommendations** For versions prior to 6.5.0, update to version 6.5.0 or later. For versions prior to 7.0.0-alpha.20, update to version 7.0.0-alpha.20 or later. As a temporary workaround, consider restricting access to the PostgreSQL database until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Azure DevOps Server (affected versions not specified) Team Foundation Server (affected versions not specified) **Description** The vulnerability is related to the deserialization mechanism in Azure DevOps Server, specifically in the MachinePropertyBag class. It allows an attacker to execute arbitrary code due to insufficient validation of untrusted data. This issue can lead to local privilege escalation. **Recommendations** For Azure DevOps Server, consider restricting access to the deserialization mechanism in the MachinePropertyBag class until a patch is available. For Team Foundation Server, restrict access to potentially vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 5.3.3 Parse Server versions prior to 4.10.20 **Description** A compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue affects Parse Server, an open source backend that can be deployed to any infrastructure that can run Node.js. **Recommendations** For versions prior to 5.3.3, update to version 5.3.3 or later. For versions prior to 4.10.20, update to version 4.10.20 or later. As a temporary workaround, consider restricting access to the Cloud Code Webhook target endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 4.10.19 Parse Server versions prior to 5.3.2 **Description** The issue allows keywords specified in the `requestKeywordDenylist` option to be injected via Cloud Code Webhooks or Triggers, resulting in the keyword being saved to the database and bypassing the `requestKeywordDenylist` option. This can be exploited by making requests to the Cloud Code Webhooks API. To mitigate this, configuring the firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API or blocking the API completely if not in use can help. **Recommendations** For versions prior to 4.10.19, update to version 4.10.19 or later. For versions prior to 5.3.2, update to version 5.3.2 or later. As a temporary workaround, consider configuring your firewall to only allow trusted servers to make requests to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 4.10.18 Parse Server versions prior to 5.3.1 on the 5.X branch **Description** Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. An attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. This issue is patched in version 5.3.1 and in 4.10.18. **Recommendations** For versions prior to 4.10.18, update to version 4.10.18 or later. For versions prior to 5.3.1 on the 5.X branch, update to version 5.3.1 or later. As a temporary workaround, consider disabling remote code execution through the MongoDB BSON parser until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Go versions prior to 1.17.11 Go versions prior to 1.18.3 **Description** The issue allows for code injection in Cmd.Start in os/exec, enabling the execution of any binaries in the working directory named either "..com" or "..exe" by calling `Cmd.Run`, `Cmd.Start`, `Cmd.Output`, or `Cmd.CombinedOutput` when `Cmd.Path` is unset. This occurs on Windows. **Recommendations** For Go versions prior to 1.17.11, update to Go 1.17.11 or later to resolve the issue. For Go versions prior to 1.18.3, update to Go 1.18.3 or later to resolve the issue. As a temporary workaround, consider setting `Cmd.Path` to a specific executable to avoid unintentional execution of binaries in the working directory.

**Name of the Vulnerable Software and Affected Versions** Azure DevOps Server and Team Foundation Server (affected versions not specified) **Description** A remote code execution issue exists due to improper input validation in Azure DevOps Server and Team Foundation Server. This could allow a remote attacker to execute arbitrary code using a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure DevOps Server and Team Foundation Server (affected versions not specified) **Description** A Cross-site Scripting (XSS) issue exists due to improper sanitization of user-provided input. This allows a remote attacker to perform cross-site scripting attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure DevOps Server and Team Foundation Server (affected versions not specified) **Description** The issue exists due to insufficient protection of the web page structure in the Azure DevOps Server and Team Foundation Server suite. Exploitation of this issue may allow a remote attacker to impact the confidentiality and integrity of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ASP.NET Core (affected versions not specified) **Description** A spoofing issue exists due to the ASP.NET Core's failure to properly sanitize web requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.