Threats tagged 'ghsa-gv55-crjh-3f3x'

Parse Server versions before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 using MongoDB do not properly validate field types for null-valued dot notation keys. This allows sub-documents to be written under fields expected to hold Pointer, Number, String, Date, or Boolean values. Clients with write access, including unauthenticated clients if public writes are enabled, can exploit this to corrupt data fields, cause objects to become unreadable, or disrupt atomic operations on number fields.