CVE-2024-52561

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 build 55740. When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change...

CVE-2024-36486

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 55740. When an archived virtual machine is restored, the prlvmarchiver tool decompresses the file and writes the content back to its original location...

CVE-2024-36486

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 55740. When an archived virtual machine is restored, the prlvmarchiver tool decompresses the file and writes the content back to its original location...

CVE-2024-52561

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 build 55740. When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change...

CVE-2024-52561

Summary: CVE-2024-52561 is a privilege-escalation vulnerability in Parallels Desktop for Mac 20.1.1 (build 55740). During snapshot deletion, the root service (prl_disp_service) verifies and may change ownership of files under the Snapshot directory. Attackers can exploit a symlink to replace the ...

CVE-2024-54189

Summary: CVE-2024-54189 is a local privilege-escalation vulnerability in Parallels Desktop for Mac 20.1.1 (build 55740). During VM snapshot creation, the root-level prl_disp_service writes metadata to a snapshot.xml file in a VM directory owned by a normal user. An attacker can replace that file ...

CVE-2024-52561

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 build 55740. When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By using a symlink, an attacker can change...

CVE-2024-54189

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 build 55740. When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary fil...

CVE-2024-54189

A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 build 55740. When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary fil...

CVE-2024-36486

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 55740. When an archived virtual machine is restored, the prlvmarchiver tool decompresses the file and writes the content back to its original location...

CVE-2024-36486

Parallels Desktop for Mac 20.1.1 (55740) has a privilege escalation flaw in the virtual machine archive restoration path. During unarchive, the root-privileged prl_vmarchiver decompresses data and writes it back to the original location; an attacker can exploit this by replacing archived data wit...

CVE-2024-36486

A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 55740. When an archived virtual machine is restored, the prlvmarchiver tool decompresses the file and writes the content back to its original location...

CVE-2025-31359

Cisco TALOS reports TALOS-2025-2160 (CVE-2025-31359) as a directory-traversal vulnerability in Parallels Desktop for Mac 20.2.2 (55879) affecting the PVMP unpacking process via prl_packer_inplace. The flaw allows a directory traversal payload to cause writes to arbitrary files, potentially enabli...

CVE-2025-31359

A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 55879. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation...

CVE-2025-31359

A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 55879. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation...

PT-2025-23598

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.1.1 build 55740 Description A privilege escalation issue exists in the Snapshot functionality of Parallels Desktop for Mac. When a snapshot of a virtual machine is taken, a root service writes to a file own...

Parallels Desktop 安全漏洞

Parallels Desktop is a suite of virtual machine software for the macOS platform from US-based Parallels, Inc. A security vulnerability exists in Parallels Desktop for Mac version 20.1.1, which stems from a hard-linking issue in the Snapshot feature that could lead to elevated privileges...

PT-2025-23599

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.2.2 Description A directory traversal vulnerability exists in the PVMP package unpacking functionality. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to...

PT-2025-23596

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.1.1 55740 Description A privilege escalation issue exists in the virtual machine archive restoration functionality. When an archived virtual machine is restored, the prl vmarchiver tool decompresses the fil...

Parallels Desktop 安全漏洞

Parallels Desktop is a suite of virtual machine software for the macOS platform from US-based Parallels, Inc. A security vulnerability exists in Parallels Desktop for Mac version 20.2.2, which stems from a directory traversal issue in the PVMP package decompression feature that could lead to...