Approved changes feed: RSS · Atom
cpe:2.3:a:erudika:para:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Erudika (cb06e019-28f1-5027-badf-7bd4c11092e3) |
|---|---|
| Product | Para (f99fe3a9-ed0c-5d4e-9f78-739c5597a2cc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-49009 |
vulnerable | 2026-06-08 07:29:12.470839 |
Para Inserts Sensitive Information into Log File for Facebook authentication
MEDIUM (6.2)
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFilter.java` results in a full request URL being logged during a failed request to a Facebook user profile. The log includes the user's access token in plain text. Since WARN-level logs are often retained in production and accessible to operators or log aggregation systems, this poses a risk of token exposure. Version 1.50.8 fixes the issue.
Published: 2025-06-05T16:40:27.978Z
Updated: 2025-06-17T13:54:23.657Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48955 |
vulnerable | 2026-06-08 07:29:12.312616 |
Para Server Logs Sensitive Information
MEDIUM (6.2)
Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.
Published: 2025-06-02T11:11:22.722Z
Updated: 2025-06-02T16:47:02.156Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1848 |
vulnerable | 2026-06-08 05:39:14.037609 |
Business Logic Errors in erudika/para
CRITICAL (9)
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
Published: 2022-05-24T10:40:09.000Z
Updated: 2024-08-03T00:17:00.744Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-1782 |
vulnerable | 2026-06-08 05:39:13.904207 |
Cross-site Scripting (XSS) - Generic in erudika/para
CRITICAL (9.4)
Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
Published: 2022-05-18T09:00:14.000Z
Updated: 2024-08-03T00:16:59.850Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.