CVE-2021-1999

CVE-2021-1999 affects Oracle ZFS Storage Appliance Kit (Oracle Systems) in the RAS subsystems with version 8.8. The vulnerability allows a high-privilege attacker who has local logon to compromise the kit, requiring user interaction. Attacks can lead to unauthorized creation, deletion, or modific...

CVE-2021-1999

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: RAS subsystems. The supported version that is affected is 8.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit...

CVE-2020-35710

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

Design/Logic Flaw

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

CVE-2020-35710

Parallels Remote Application Server (RAS) 18 is affected. The issue allows remote attackers to discover an intranet IP address because, after submitting the login form (even with blank credentials), the attacker's client receives the host IP via a second request to RASHTML5Gateway/socket.io conta...

Microsoft Issues Emergency Security Updates for Windows 8.1 and Server 2012 R2

Microsoft has issued an emergency out-of-band software update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 systems to patch two new recently disclosed security vulnerabilities. Tracked as CVE-2020-1530 and CVE-2020-1537, both flaws reside in the Remote Access Service RAS in a way i...

CVE-2020-15860

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

CVE-2020-15860

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

CVE-2020-15860

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

CVE-2020-15860

Parallels RAS 17.1.1 is affected by a Business Logic Error (CVE-2020-15860) that allows an authenticated user to execute any backend operating-system application via the web application and to access hosts in the internal domain without having published apps. Core Security’s advisory (CORE-2020-0...

: Parallels RAS OS Command Execution

1. Advisory Information Title : Parallels RAS OS Command Execution Advisory ID : CORE-2020-0011 Advisory URL:https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution Date published : 2020-07-23 Date of last update : 2020-07-21 Vendors contacted : Parallels Release mode...

Unbreakable Enterprise kernel security update

4.14.35-1902.11.3 - xfs: do async inactivation only when fs freezed Junxiao Bi Orabug: 31013775 4.14.35-1902.11.2 - ib/core: Cancel fmr delayedworker when in shutdown phase of reboot system Hans Westgaard Ry Orabug: 30967501 - Revert 'printk: Default console logging level should be set to 4' Cesa...

JasPer Null Pointer Dereference Vulnerability

JasPer is a Canadian software developer Michael Adams developed an open source implementation of the JPEG-2000 codec. A null pointer dereference vulnerability exists in the 'rasputdatastd' function in the ras/rasenc.c file in JasPer version 2.0.14, which can be exploited by an attacker to cause a...

Parallels Remote Application Server 15.5 Path Traversal Vulnerability

Exploit for windows platform in category web applications Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides - RUNESEC Vendor Homepage: https://www.parallels.com/...

Path traversal

In the web interface of Parallels Remote Application Server RAS 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary...

CVE-2017-9447

Parallels Remote Application Server (RAS) 15.5 Build 16140 web interface is vulnerable to a path traversal issue due to improper validation of file paths when requesting resources under the RASHTML5Gateway directory. A remote, unauthenticated attacker could exploit this to read arbitrary files on...

ActivePDF Toolkit Code Execution

ActivePDF Toolkit 8.1.0 multiple RCE Introduction ============ The ActivePDF Toolkit is a Windows library which enhances business processes to stamp, stitch, merge, form-fill, add digital signatures, barcodes to PDF. Both .NET and native APIs are provided. Amongst many other operations, this...

Parallels Remote Application Server 15.5 - Path Traversal

Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides - RUNESEC Vendor Homepage: https://www.parallels.com/ Affected: Parallels Remote Application Server RAS 15.5 Bui...

Parallels Remote Application Server 15.5 - Path Traversal

Parallels Remote Application Server 15.5 - Path Traversal. CVE-2017-9447. Webapps exploit for Windows platform Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides -...

Parallels Remote Application Server 15.5 - Path Traversal

Parallels Remote Application Server 15.5 - Path Traversal Exploit Title: Parallels Remote Application Server RAS 15.5 Path Traversal Date: 22-02-2018 Exploit Author: Nicolas Markitanis - RUNESEC Reviewers: Simon Loizides and Marios Nicolaides - RUNESEC Vendor Homepage: https://www.parallels.com/...