deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-22879
Published: 2021-04-14
Description: Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-99, CWE-74
References: https://github.com/nextcloud/desktop/pull/2906; https://hackerone.com/reports/1078002; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTWBJAS5DJJIK7LLVBZZQTSJASUVIRVE/
CVE: CVE-2020-19778
Published: 2021-04-14
Description: Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the parameter "user_id" in the HTML request.
CVSS Score: 9.8 (CRITICAL)
References: https://cwe.mitre.org/data/definitions/472.html; https://github.com/gongfuxiang/shopxo/issues/23; https://cwe.mitre.org/data/definitions/472.html
CVE: CVE-2020-21087
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/X2Engine/X2CRM/issues/162; https://github.com/X2Engine/X2CRM/issues/162
CVE: CVE-2020-21088
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/X2Engine/X2CRM/issues/161; https://github.com/X2Engine/X2CRM/issues/183; https://github.com/X2Engine/X2CRM/issues/161
CVE: CVE-2020-36120
Published: 2021-04-14
Description: Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/saitoha/libsixel/issues/143; https://github.com/saitoha/libsixel/issues/143
CVE: CVE-2021-26805
Published: 2021-04-14
Description: Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a malicious WAV file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/395; https://github.com/justdan96/tsMuxer/issues/395
CVE: CVE-2021-26812
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/udima-university/moodle-mod_jitsi/issues/67; https://github.com/udima-university/moodle-mod_jitsi/issues/67
CVE: CVE-2021-26827
Published: 2021-04-14
Description: Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sending an HTTP request with a very long "ssid" parameter to the "/userRpm/popupSiteSurveyRpm.html" webpage, which crashes the router.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/GD008/vuln/blob/main/tplink_wr2041/tplink_WR2041pv1.md; https://github.com/GD008/vuln/blob/main/tplink_wr2041/tplink_WR2041pv1.md
CVE: CVE-2021-26832
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/NagliNagli/CVE-2021-26832; https://github.com/NagliNagli/CVE-2021-26832
CVE: CVE-2021-27113
Published: 2021-04-14
Description: An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/GD008/vuln/blob/main/DIR-816_2.md; https://www.dlink.com/en/security-bulletin/; https://github.com/GD008/vuln/blob/main/DIR-816_2.md
CVE: CVE-2021-27114
Published: 2021-04-14
Description: An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/GD008/vuln/blob/main/DIR-816_stackoverflow.md; https://www.dlink.com/en/security-bulletin/; https://github.com/GD008/vuln/blob/main/DIR-816_stackoverflow.md
CVE: CVE-2021-27288
Published: 2021-04-14
Description: Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/X2Engine/X2CRM/issues/183; https://github.com/X2Engine/X2CRM/issues/183
CVE: CVE-2021-27815
Published: 2021-04-14
Description: NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/libexif/exif/commit/eb84b0e3c5f2a86013b6fcfb800d187896a648fa; https://github.com/libexif/exif/commit/f6334d9d32437ef13dc902f0a88a2be0063d9d1c; https://github.com/libexif/exif/issues/4
CVE: CVE-2021-27990
Published: 2021-04-14
Description: Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://appspace.com; https://github.com/syedsohaibkarim/PoC-BrokenAuth-AppSpace6.2.4; http://appspace.com
CVE: CVE-2021-28300
Published: 2021-04-14
Description: NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to execute arbitrary code or cause a Denial-of-Service (DoS) by uploading a malicious MP4 file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/1702; https://github.com/gpac/gpac/issues/1702
CVE: CVE-2021-29338
Published: 2021-04-14
Description: Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/uclouvain/openjpeg/issues/1338; https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/
CVE: CVE-2021-31152
Published: 2021-04-14
Description: Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can enable remote access, change passwords, and perform other actions through misconfigured requests, entries, and headers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/162258/Multilaser-Router-RE018-AC1200-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2024/Mar/1; https://www.youtube.com/watch?v=zN3DVrcu6Eg
CVE: CVE-2020-29592
Published: 2021-04-14
Description: An issue was discovered in Orchard before 1.10. A broken access control issue in Orchard components that use the TinyMCE HTML editor's file upload allows an attacker to upload dangerous executables that bypass the file types allowed (regardless of the file types allowed list in Media settings).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://burninatorsec.blogspot.com/2021/04/cve-2020-29592-and-cve-2020-29593.html; https://github.com/OrchardCMS/Orchard/releases; https://burninatorsec.blogspot.com/2021/04/cve-2020-29592-and-cve-2020-29593.html
CVE: CVE-2020-29593
Published: 2021-04-14
Description: An issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field allows an attacker to add a XSS payload that will execute when users attempt to upload a disallowed file type, causing the error to display.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://burninatorsec.blogspot.com/2021/04/cve-2020-29592-and-cve-2020-29593.html; https://github.com/OrchardCMS/Orchard/releases; https://burninatorsec.blogspot.com/2021/04/cve-2020-29592-and-cve-2020-29593.html
CVE: CVE-2021-25314
Published: 2021-04-14
Description: A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git[PII_REDACTED].812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git[PII_REDACTED].812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git[PII_REDACTED].af555ad9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-378, CWE-668
References: https://bugzilla.suse.com/show_bug.cgi?id=1182166; https://bugzilla.suse.com/show_bug.cgi?id=1182166
CVE: CVE-2021-27130
Published: 2021-04-14
Description: Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/161219/Online-Reviewer-System-1.0-SQL-Injection-Shell-Upload.html; https://packetstormsecurity.com/files/161219/Online-Reviewer-System-1.0-SQL-Injection-Shell-Upload.html
CVE: CVE-2021-27599
Published: 2021-04-14
Description: SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Integration Builder Framework), versions - 7.10, 7.30, 7.31, 7.40, 7.50, allows an attacker to access information under certain conditions, which would otherwise be restricted.
CVSS Score: 6.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/3012277; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3012277
CVE: CVE-2021-27604
Published: 2021-04-14
Description: In order to prevent XML External Entity vulnerability in SAP NetWeaver ABAP Server and ABAP Platform (Process Integration - Enterprise Service Repository JAVA Mappings), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, SAP recommends to refer this note.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://launchpad.support.sap.com/#/notes/3036436; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3036436
CVE: CVE-2021-27608
Published: 2021-04-14
Description: An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable file is registered. This could further lead to complete compromise of confidentiality, Integrity and Availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-428
References: https://launchpad.support.sap.com/#/notes/3039649; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649; https://launchpad.support.sap.com/#/notes/3039649
CVE: CVE-2021-27705
Published: 2021-04-14
Description: Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"qosIndex "request. This occurs because the "formQOSRuleDel" function directly passes the parameter "qosIndex" to strcpy without limit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://hackmd.io/Zb7lfFaNR0ScpaTssECFbg; https://hackmd.io/Zb7lfFaNR0ScpaTssECFbg
CVE: CVE-2021-27706
Published: 2021-04-14
Description: Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"IPMacBindIndex "request. This occurs because the "formIPMacBindDel" function directly passes the parameter "IPMacBindIndex" to strcpy without limit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://hackmd.io/BhzJ4H20TjqKUiBrDOIKaw; https://hackmd.io/BhzJ4H20TjqKUiBrDOIKaw
CVE: CVE-2021-27707
Published: 2021-04-14
Description: Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"portMappingIndex "request. This occurs because the "formDelPortMapping" function directly passes the parameter "portMappingIndex" to strcpy without limit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://hackmd.io/U7OVgYIuRcOKV7SW5-euHw; https://hackmd.io/U7OVgYIuRcOKV7SW5-euHw
CVE: CVE-2021-28098
Published: 2021-04-14
Description: An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged location such as %WINDIR%\System32. The resulting log file adopts the file permissions of the source of the symbolic link (in this case, the Everyone group). The log file in System32 can be replaced and renamed with a malicious DLL for DLL hijacking.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-427, CWE-732
References: https://docs.forescout.com; https://jordanpotti.com/2021/03/30/forescout-priv-esc-folder-permissions/; https://www.adversis.io/research/2021/3/30/forescout-secure-connector-local-privilege-escalation
CVE: CVE-2021-30493
Published: 2021-04-14
Description: Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://versprite.com/advisories/razer-synapse-3-cve-2021-30493/; https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report/; https://versprite.com/security-resources/
CVE: CVE-2021-30494
Published: 2021-04-14
Description: Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://versprite.com/advisories/razer-synapse-3-1/; https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report/; https://versprite.com/security-resources/
CVE: CVE-2021-27246
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of MAC addresses by the tdpServer endpoint. A crafted TCP message can write stack pointers to the stack. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-12306.
CVSS Score: 8.0 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-21-215/; https://www.zerodayinitiative.com/advisories/ZDI-21-215/
CVE: CVE-2021-27247
Published: 2021-04-14
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WXAM decoder. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-11907.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-21-217/; https://www.zerodayinitiative.com/advisories/ZDI-21-217/
CVE: CVE-2021-27248
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the getpage parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-10932.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-203/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-27249
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11369.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-204/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-27250
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of CGI scripts. When parsing the errorpage request parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-11856.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201; https://www.zerodayinitiative.com/advisories/ZDI-21-205/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10201
CVE: CVE-2021-27251
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not required to exploit this vulnerability The specific flaw exists within handling of firmware updates. The issue results from a fallback to a insecure protocol to deliver updates. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12308.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders; https://www.zerodayinitiative.com/advisories/ZDI-21-247/; https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders
CVE: CVE-2021-27252
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the vendor_specific DHCP opcode. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12216.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders; https://www.zerodayinitiative.com/advisories/ZDI-21-248/; https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders
CVE: CVE-2021-27253
Published: 2021-04-14
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the rc_service parameter provided to apply_bind.cgi. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12303.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders; https://www.zerodayinitiative.com/advisories/ZDI-21-249/; https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders
CVE: CVE-2021-27258
Published: 2021-04-14
Description: This vulnerability allows remote attackers to execute escalate privileges on affected installations of SolarWinds Orion Platform 2020.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SaveUserSetting endpoint. The issue results from improper restriction of this endpoint to unprivileged users. An attacker can leverage this vulnerability to escalate privileges their privileges from Guest to Administrator. Was ZDI-CAN-11903.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://www.zerodayinitiative.com/advisories/ZDI-21-192/; https://www.zerodayinitiative.com/advisories/ZDI-21-192/
CVE: CVE-2021-27259
Published: 2021-04-14
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12021.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-212/; https://kb.parallels.com/en/125013