CVE-2023-27326

Parallels Desktop VM 탈출 이 저장소에는 CVE-2023-27326으로 지정된 Parallels Desktop 취약점에 대한 익스플로잇이 포함되어 있습니다. 이 취약점은 로컬 공격자가 영향을 받는 Parallels Desktop 설치 환경에서 권한을 상승시킬 수 있게 합니다. 이 익스플로잇은 Parallels Desktop 18.0.053049 버전에서 테스트되었으며, 해당 취약점은 18.1.153328 보안 업데이트에서 패치되었습니다. 취약점 세부 정보 구체적인 결함은 Toolgate 구성 요소에 존재합니다....

parallels-plist-escape

parallels-plist-escape 이 저장소에는 CVE-2023-27327 및 CVE-2023-27328에 대한 익스플로잇이 포함되어 있으며, 두 취약점을 함께 사용하여 Parallels Desktop 18.1.1 이전 버전의 Parallels Desktop 가상 머신에서 탈출할 수 있습니다. 또한 필수 커널 모듈의 코드가 prlmod에 포함되어 있으며, 이를 사용하여 /proc/driver/prltgpwn에 생성된 proc 항목을 통해 사용자 공간에서 임의의 Toolgate 요청 opcode 0x8000을 보낼 수...

Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting

Parallels H-Sphere 3.0.0 P9 and 3.1 P1 contains multiple cross-site scripting vulnerabilities in login.php in webshell4. An attacker can inject arbitrary web script or HTML via the err, errorcode, and login parameters, thus allowing theft of cookie-based authentication credentials and launch of...

parallels-file-move-privesc

parallels-file-move-privesc 이 저장소는 CVE-2023-50226 / ZDI-CAN-21227에 대한 익스플로잇을 포함하며, 18.3.2 이전 버전의 Parallels Desktop에서 루트로 권한 상승하는 데 사용할 수 있습니다...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. id: CVE-2022-30777 info: name: Parallels H-Sphere 3.6.1713 - Cross-Site Scripting author: 3th1cyuk1 severity: medium description: | Parallels H-Sphere 3.6.1713 contains a cross-site...

CVE-2023-27326

Parallels Desktop VM 탈출 이 저장소는 Parallels Desktop의 취약점CVE-2023-27326에 대한 익스플로잇을 포함하고 있습니다. 이 취약점은 로컬 공격자가 영향을 받는 Parallels Desktop 설치에서 권한을 상승시킬 수 있도록 합니다. 이 익스플로잇은 Parallels Desktop 버전 18.0.0 53049에서 테스트되었으며, 취약점은 18.1.1 53328 보안 업데이트에서 패치되었습니다. 취약점 세부 정보 특정 결함은 Toolgate 구성 요소에 존재합니다. 이 문제는 파일 작업...

Parallels Desktop < 27.0.0 Local Privilege Escalation (macOS)

The version of Parallels Desktop installed on the remote macOS host is prior to 27.0.0. It is, therefore, affected by a privilege escalation vulnerability: - Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket...

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix i...

CVE-2026-90894

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894

Parallels Desktop (macOS) contains a local privilege escalation vulnerability in the prl_disp_service daemon, which runs as root . Local clients reach it via a world-writable socket, and PrlSrv_LoginLocal accepts peer credentials with no signature or admin-group check. After login, PrlSrv_Install...

EUVD-2026-77346

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-90894 Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

PT-2026-91137

Name of the Vulnerable Software and Affected Versions Parallels Desktop versions prior to 27.0.0 Description A local privilege escalation issue exists in Parallels Desktop for Mac where an unprivileged local user can execute code as root. The prl disp service daemon runs with root privileges and...

CVE-2026-90894: Improper Neutralization of Argument Delimiters in a Command

Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket. PrlSrvLoginLocal accepts peer credentials. No Parallels signature. No admin group. After login, PrlSrvInstallAppliance lets you pick the appliance folder sVmParentPat...

CVE-2026-18262

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-18263

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-13121

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

EUVD-2026-63464

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...

CVE-2026-18263 Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...