Parallels Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/parallels/ Sun, 26 Feb 2023 09:11:48 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Parallels Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/parallels/ 32 32 CVE-2008-6984 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6984/ Sun, 26 Feb 2023 09:11:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6984/ Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as demonstrated using (a) SMTP and qmail, and (b) Courier IMAP and […]

The post CVE-2008-6984 appeared first on CVE Vulnerability.

]]> Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via a message with (1) a base64-encoded username that begins with a valid shortname, or (2) a username that matches a valid password, as demonstrated using (a) SMTP and qmail, and (b) Courier IMAP and POP3.

The post CVE-2008-6984 appeared first on CVE Vulnerability.

]]> CVE-2008-6479 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6479/ Sun, 26 Feb 2023 09:11:32 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6479/ Cross-site request forgery (CSRF) vulnerability in the “change password” feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.

The post CVE-2008-6479 appeared first on CVE Vulnerability.

]]> Cross-site request forgery (CSRF) vulnerability in the “change password” feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.

The post CVE-2008-6479 appeared first on CVE Vulnerability.

]]> CVE-2008-6478 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6478/ Sun, 26 Feb 2023 09:11:32 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6478/ Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag to (1) create-file and (2) list-control in vz/cp/vzdir/infrman/envs/files/; or modify system configuration via […]

The post CVE-2008-6478 appeared first on CVE Vulnerability.

]]> Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag to (1) create-file and (2) list-control in vz/cp/vzdir/infrman/envs/files/; or modify system configuration via the path parameter to vz/cp/vzdir/infrman/envs/files/index.

The post CVE-2008-6478 appeared first on CVE Vulnerability.

]]> CVE-2008-6465 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6465/ Sun, 26 Feb 2023 09:11:32 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6465/ Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.

The post CVE-2008-6465 appeared first on CVE Vulnerability.

]]> Multiple cross-site scripting (XSS) vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the (1) err, (2) errorcode, and (3) login parameters.

The post CVE-2008-6465 appeared first on CVE Vulnerability.

]]> CVE-2007-4009 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-4009/ Sun, 26 Feb 2023 09:07:00 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-4009/ PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.

The post CVE-2007-4009 appeared first on CVE Vulnerability.

]]> PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.

The post CVE-2007-4009 appeared first on CVE Vulnerability.

]]> CVE-2020-8968 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8968/ Sun, 26 Feb 2023 06:43:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8968/ Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.

The post CVE-2020-8968 appeared first on CVE Vulnerability.

]]> Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an attacker is able to recover the profile password.

The post CVE-2020-8968 appeared first on CVE Vulnerability.

]]> CVE-2020-35710 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-35710/ Sun, 26 Feb 2023 06:41:22 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-35710/ Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker’s client for use as a “host” value. In other words, after an attacker’s web browser sent a request to the login form, it would […]

The post CVE-2020-35710 appeared first on CVE Vulnerability.

]]> Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker’s client for use as a “host” value. In other words, after an attacker’s web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like “host”:”192.168.###.###” in the POST data.

The post CVE-2020-35710 appeared first on CVE Vulnerability.

]]> CVE-2020-15860 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15860/ Sun, 26 Feb 2023 06:38:00 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15860/ Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the […]

The post CVE-2020-15860 appeared first on CVE Vulnerability.

]]> Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm.

The post CVE-2020-15860 appeared first on CVE Vulnerability.

]]> CVE-2019-18793 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18793/ Sun, 26 Feb 2023 06:31:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18793/ Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the “fileName” parameter.

The post CVE-2019-18793 appeared first on CVE Vulnerability.

]]> Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the “fileName” parameter.

The post CVE-2019-18793 appeared first on CVE Vulnerability.

]]> CVE-2021-34987 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-34987/ Thu, 23 Feb 2023 14:10:24 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-34987/ This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the HDAudio virtual device. The issue results from the lack of proper […]

The post CVE-2021-34987 appeared first on CVE Vulnerability.

]]> This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the HDAudio virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-14969.

The post CVE-2021-34987 appeared first on CVE Vulnerability.

]]>