CVE-2021-34855

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Design/Logic Flaw

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the getpage parameter provided to th...

Stack overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint, which listens on TCP port 80 by defaul...

Memory corruption

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

Stack overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webpr...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

CVE-2021-34864

Parallels Desktop 16.1.3 is affected by a local privilege-escalation in the WinAppHelper component due to improper access control. An attacker with low-privileged code execution in the guest can escalate to the hypervisor context and execute arbitrary code. Root cause: lack of proper access contr...

CVE-2021-34863

CVE-2021-34863 affects D-Link DAP-2020 1.01rc001 routers. A stack-based buffer overflow occurs in the webproc endpoint when processing the var:page parameter due to insufficient validation of input length, enabling network-adjacent attackers to execute code with root privileges. Documented by ZDI...

CVE-2021-34862

The CVE-2021-34862 entry pertains to D-Link DAP-2020 routers (firmware around 1.01rc001) with a stack-based buffer overflow in the webproc endpoint caused by improper validation of the var:menu parameter. Reported as a remote code execution vulnerability, it can be exploited by network-adjacent a...

CVE-2021-34862

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webpr...

CVE-2021-34861

This CVE affects D-Link DAP-2020 routers, specifically version 1.01rc001, where the webproc endpoint handling on TCP port 80 does improper length validation of user data, causing a stack-based overflow that can allow root-level code execution by network-adjacent attackers with no authentication. ...

CVE-2021-34860

The CVE-2021-34860 issue affects D-Link DAP-2020 routers (version 1.01rc001) and is a directory traversal flaw in the webproc getpage endpoint. The vulnerability arises from insufficient validation of a user-supplied path used in file operations, enabling network-adjacent attackers to disclose se...

CVE-2021-34859

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...

CVE-2021-34859

CVE-2021-34859 affects TeamViewer 15.16.8.0. The issue stems from improper validation during parsing of TVS files, leading to memory corruption that enables remote code execution in the context of the current process. Exploitation requires user interaction (the target opens a malicious file or vi...

CVE-2021-34857

Parallels Desktop 16.1.3 (49160) is affected by CVE-2021-34857 due to a Toolgate out-of-bounds write caused by insufficient input validation. This local privilege-escalation flaw allows an attacker able to execute high-privileged code on the guest to run arbitrary code in the hypervisor context. ...

CVE-2021-34856

CVE-2021-34856 affects Parallels Desktop 16.1.3 (49160). The vulnerability is in the virtio-gpu virtual device and stems from improper validation of user-supplied data, causing a memory corruption condition that can be exploited by a local attacker to escalate privileges and execute arbitrary cod...

CVE-2021-34855

CVE-2021-34855 affects Parallels Desktop 16.1.3 (49160) and involves the Toolgate component. The issue arises from uninitialized memory access in Toolgate, allowing a local attacker who can run low-privileged code on the guest to disclose sensitive information. The vulnerability can be leveraged ...