The fix included in versions 5.4.4 and 6.1.1 adds a new Parse Server option `fileUpload.fileExtensions` to restrict file upload on Parse Server by file extension. A malicious HTML file could contain a script that retrieves the user's session token from local storage and then share it with the attacker. The SDK stores sessions in the internet browser's local storage, which usually restricts data access depending on the internet domain. The HTML page may seem legitimate because it is served under the internet domain where Parse Server is hosted, which may be the same as a company's official website domain.Īn additional security issue arises when the Parse JavaScript SDK is used. The URL of the the uploaded HTML could be shared for phishing attacks. That HTML file would then be accessible at the internet domain at which Parse Server is hosted.
A malicious user could upload an HTML file to Parse Server via its public API. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. Please ensure you have registered your company, failing which any quotations submitted will unfortunately not be considered until such time as the legislation has been adhered to.Īs an entity of the eThekwini Municipality, uShaka Marine World is committed to stamping out fraud and corruption.Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Failing to register on the National Treasury’s database will result in your business being non-compliant with the legislation and as a consequence will not be permitted to transact with eThekwini Municipality.Īfter successfully registering on the Central Supplier Database, suppliers are to ensure that they are also registered on the eThekwini Vendor Portal on and must ensure that all supporting documentation is provided. In compliance with the Municipal Finance Management Act (MFMA), No 56 of 2003 and its Municipal Supply Chain Management Regulation 14, eThekwini Municipality hereby requests all suppliers of goods and services are to apply to be registered on its supplier database via National Treasury’s Centralised Supplier Database.
0 kommentar(er)
