PT-2022-25595 · Parallels · Parallels Remote Application Server

Name of the Vulnerable Software and Affected Versions: Parallels Remote Application Server version 18.0 Description: The issue allows attackers to execute arbitrary commands via a crafted payload injected into the Host header, which is a result of a Host Header Injection attack. This enables...

CVE-2022-40870

CVE-2022-40870 affects the Web Client of Parallels Remote Application Server v18.0. The issue is a Host Header Injection that allows an attacker to execute arbitrary commands via a crafted payload in the Host header. CVSSv3.1 base score 8.1 (High) with network access, high complexity, no privileg...

CVE-2022-40870: Improper Encoding or Escaping of Output

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

Unspecified Vulnerability in Parallels Remote Application Server

Parallels Remote Application Server RAS is an application delivery and VDI Virtual Desktop Infrastructure solution from Parallels, Inc. A security vulnerability exists in Parallels Remote Application Server RAS that originated from a vulnerability that allows a local attacker to retrieve certain...

CVE-2020-8968

CVE-2020-8968 affects Parallels Remote Application Server (RAS). A local attacker can retrieve certain profile passwords in clear text by uploading a previously stored cyphered file, compromising confidentiality (and potentially integrity/availability of user data). Exploitation is local and requ...

Parallels Remote Application Server 安全漏洞

Parallels Remote Application Server RAS is an application delivery and VDI Virtual Desktop Infrastructure solution from Parallels, Inc. A security vulnerability exists in Parallels Remote Application Server RAS that originated from a vulnerability that allows a local attacker to retrieve certain...

CVE-2020-8968: Undefined Security Weakness

Parallels Remote Application Server RAS allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cyphered file by Parallels RAS. The confidentiality, availability and integrity of the information of the user could be compromised if an...

CVE-2020-35710

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

PT-2020-17399

Name of the Vulnerable Software and Affected Versions Parallels Remote Application Server RAS version 18 Description The issue allows remote attackers to discover an intranet IP address. This occurs because submission of the login form, even with blank credentials, provides the intranet IP addres...

CVE-2020-35710: Exposure of Sensitive Information to an Unauthorized Actor

Parallels Remote Application Server RAS 18 allows remote attackers to discover an intranet IP address because submission of the login form even with blank credentials provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a...

Parallels Remote Application Server (RAS) Remote Code Execution Vulnerability

Parallels Remote Application Server RAS is a comprehensive virtual application and desktop delivery solution for your employees to access and use applications and data from any device. A remote code execution vulnerability exists in Parallels Remote Application Server RAS 17.1.1. The vulnerabilit...

Remote code execution

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

CVE-2020-15860

Parallels RAS 17.1.1 is affected by a Business Logic Error (CVE-2020-15860) that allows an authenticated user to execute any backend operating-system application via the web application and to access hosts in the internal domain without having published apps. Core Security’s advisory (CORE-2020-0...

PT-2020-14671 · Parallels · Parallels Remote Application Server

Name of the Vulnerable Software and Affected Versions: Parallels Remote Application Server RAS version 17.1.1 Description: The issue is a Business Logic Error that allows remote code execution. It enables an authenticated user to execute any application in the backend operating system through the...

CVE-2020-15860: Undefined Security Weakness

Parallels Remote Application Server RAS 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it wa...

Parallels Remote Application Server Path Traversal Vulnerability

Parallels Remote Application Server RAS is a suite of virtual application and desktop delivery solutions from Parallels, Inc. in the United States. The solution provides remote access to virtual desktops and applications for devices on the network. A security vulnerability exists in the web...

Parallels Remote Application Server (RAS) Detection (HTTP)

HTTP based detection of Parallels Remote Application Server RAS. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Path traversal

In the web interface of Parallels Remote Application Server RAS 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary...

CVE-2017-9447

In the web interface of Parallels Remote Application Server RAS 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary...

CVE-2017-9447

In the web interface of Parallels Remote Application Server RAS 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. A remote, unauthenticated attacker could exploit this weakness to read arbitrary...