CVE-2022-28672

Foxit PDF Reader 11.2.1.53537 is affected by CVE-2022-28672 due to improper validation of object existence in Doc objects, enabling arbitrary code execution with user interaction (open a malicious file/page). Root cause: memory/object handling flaw in Doc objects. Impact: remote code execution in...

CVE-2022-28671

Foxit PDF Reader 11.2.1.53537 is affected by CVE-2022-28671 due to improper validation of Doc objects, enabling code execution in the current process when a user visits a malicious page or opens a malicious file. Exploitation requires user interaction (UI:R) and the attack vector is Local with hi...

CVE-2022-28670

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-28670

Foxit PDF Reader 11.2.1.53537 is affected by CVE-2022-28670 due to a flaw in AcroForms handling that can trigger a read past the end of an allocated buffer, enabling disclosure of sensitive data and potentially enabling arbitrary code execution when combined with other vulnerabilities. Concrete d...

CVE-2022-28669

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-28669

CVE-2022-28669 affects Foxit PDF Reader 11.2.1.53537. The flaw lies in handling of Doc objects where the existence of an object is not validated before operations, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious page or opening a...

CVE-2022-34900

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 39313 Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2022-34890

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 51537. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw...

CVE-2022-34902

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 39316 Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2022-34902

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 39316 Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2022-34891

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 39316 Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 39313 Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2022-34902

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 39316 Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

CVE-2022-34902

Parallels Access 6.5.4 Agent is affected by CVE-2022-34902. The Desktop Control Agent loads Qt plugins from an unsecured location, enabling a local attacker who can run low-privilege code to escalate to SYSTEM and execute arbitrary code. This is a local privilege escalation via an uncontrolled se...

CVE-2022-34901

CVE-2022-34901 affects Parallels Access Agent 6.5.4 (39316). The flaw resides in the Parallels Service, which executes files from an unsecured location, enabling a local attacker who can run low-privileged code to escalate to root and execute arbitrary code. The vulnerability is labeled as a loca...

CVE-2022-34900

CVE-2022-34900 affects Parallels Access Agent 6.5.3 (39313). The Dispatcher service loads an OpenSSL configuration file from an unsecured location, enabling a local attacker who can run low-privileged code to escalate to SYSTEM and execute arbitrary code. Documented by ZDI-22-945 (and related fee...

CVE-2022-34899

CVE-2022-34899 affects Parallels Access 6.5.4 (39316) Agent. A local attacker who can run low-privilege code can abuse a flaw in the Parallels service by using symbolic links to escalate privileges and execute arbitrary code as root. Root-level impact is stated; the flaw is tied to a local privil...

CVE-2022-34892

CVE-2022-34892 affects Parallels Desktop 17.1.1 on macOS. A race-condition in the updater mechanism (due to lack of proper locking when operating on an object) can be exploited by a local attacker who already has low-privilege code execution to escalate to root and execute arbitrary code. The iss...

Corel Parallels Desktop 安全漏洞

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. A security vulnerability exists in Corel Parallels Desktop version 17.1.1 51537, which stems from a vulnerability that allows a local attacker to disclose sensitive information on an affected...