CVE-2020-7213

Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a parallelsupdates.xml file on the http://update.parallels.com web site...

CVE-2020-7213

Parallels 13 vulnerable to MITM through its update process due to use of cleartext HTTP for updates (parallels_updates.xml at update.parallels.com). The issue is documented across CVE-2020-7213 sources (NVD, Red Hat, CVE lists). Impact described as exposure/integrity risk during update delivery. ...

CVE-2019-17148

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 45485. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The...

CVE-2019-17148

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 45485. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 45485. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The...

CVE-2019-17148

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 45485. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The...

CVE-2019-17148

CVE-2019-17148 describes a local privilege escalation in Parallels Desktop (v14.1.3, build 45485). The flaw is in the Parallels Service and results from improper validation of a user-supplied string before it is used to perform a system call, enabling an attacker with low-privilege code execution...

Corel Parallels Desktop Command Injection Vulnerability

Corel Parallels Desktop is a suite of virtual machine software for the macOS platform from Corel Canada. A command injection vulnerability exists in Corel Parallels Desktop that originates when the program makes a direct system call without properly validating a user-submitted string. A local...

Parallels Desktop Command Injection Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Parallel...

Virtuozzo 6 : parallels-kernel-modules / etc (VZA-2019-093)

According to the version of the parallels-kernel-modules / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - libVNCServer-0.9.10 contains a memory leak in VNC server code, which may allow an attacker to read stack memory. Note tha...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2019-089)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - hw: Machine Check Error on Page Size Change IFU - hw: Intel GPU blitter manipulation can allow for...

Parallels Plesk Panel Cross-Site Scripting Vulnerability (CNVD-2020-41525)

Parallels Plesk Panel is a control panel for the Plesk web hosting platform from Parallels USA. A cross-site scripting vulnerability exists in Parallels Plesk Panel version 9.5 in target/locales/tr-TR/help/index.htm? that can be exploited to inject JavaScript via the "fileName" parameter...

CVE-2019-18793

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...

CVE-2019-18793

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...

Cross site scripting

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...

CVE-2019-18793

CVE-2019-18793 affects Parallels Plesk Panel 9.5 with a stored/reflected XSS in target/locales/tr-TR/help/index.htm? via the fileName parameter. The issue is a cross-site scripting flaw in that specific page, allowing injected script to be treated as part of the web page. Several connected source...

CVE-2019-18793

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...

Buffer Overflow

KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM in environments managed by Red Hat Enterprise Virtualization Manager. Multiple integer...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-041)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - The dogetmempolicy function in 'mm/mempolicy.c' in the Linux kernel allows local users to hit a...

Virtuozzo 6 : parallels-server-bm-release / etc (VZA-2018-017)

According to the versions of the parallels-server-bm-release / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel through 4.14.13, the rdsmessageallocsgs function does not validate a value that is used during...