deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-21995
Published: 2021-04-29
Description: Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.exploit-db.com/exploits/47763; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php; https://www.exploit-db.com/exploits/47763
CVE: CVE-2020-21997
Published: 2021-04-29
Description: Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/306.html; https://www.exploit-db.com/exploits/47596; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php
CVE: CVE-2020-22002
Published: 2021-04-29
Description: An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172839; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/172839
CVE: CVE-2021-20090
Published: 2021-04-29
Description: A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.kb.cert.org/vuls/id/914124; https://www.secpod.com/blog/arcadyan-based-routers-and-modems-under-active-exploitation/; https://www.tenable.com/security/research/tra-2021-13
CVE: CVE-2021-20091
Published: 2021-04-29
Description: The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution.
CVSS Score: 8.8 (HIGH)
References: https://www.tenable.com/security/research/tra-2021-13; https://www.tenable.com/security/research/tra-2021-13
CVE: CVE-2021-20092
Published: 2021-04-29
Description: The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.tenable.com/security/research/tra-2021-13; https://www.tenable.com/security/research/tra-2021-13
CVE: CVE-2021-20095
Published: 2021-04-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2021-27651
Published: 2021-04-29
Description: In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix; https://collaborate.pega.com/discussion/pega-security-advisory-a21-hotfix-matrix
CVE: CVE-2021-28280
Published: 2021-04-29
Description: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://anotepad.com/notes/2skndayt; https://github.com/PHPFusion/PHPFusion/commit/08d6c2ea49bd06fcce32275252f5f25abe61965c; https://github.com/PHPFusion/PHPFusion/commit/1c2b32321cf11ed1cd3ff835f8da0d172c849ce6
CVE: CVE-2021-28899
Published: 2021-04-29
Description: Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.
CVSS Score: 7.5 (HIGH)
References: http://lists.live555.com/pipermail/live-devel/2021-March/021891.html; http://lists.live555.com/pipermail/live-devel/2021-March/021891.html
CVE: CVE-2021-30027
Published: 2021-04-29
Description: md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://github.com/mity/md4c/commit/4fc808d8fe8d8904f8525bb4231d854f45e23a19; https://github.com/mity/md4c/issues/155; https://github.com/mity/md4c/commit/4fc808d8fe8d8904f8525bb4231d854f45e23a19
CVE: CVE-2021-30218
Published: 2021-04-29
Description: samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918; https://github.com/michaelforney/samurai/issues/67; https://github.com/michaelforney/samurai/commit/e84b6d99c85043fa1ba54851ee500540ec206918
CVE: CVE-2021-30219
Published: 2021-04-29
Description: samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/michaelforney/samurai/commit/d2af3bc375e2a77139c3a28d6128c60cd8d08655; https://github.com/michaelforney/samurai/issues/68; https://github.com/michaelforney/samurai/commit/d2af3bc375e2a77139c3a28d6128c60cd8d08655
CVE: CVE-2021-30224
Published: 2021-04-29
Description: Cross Site Request Forgery (CSRF) in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://forum.rukovoditel.net/viewtopic.php?f=19&t=2760; https://gist.github.com/victomteng1997/d5f2db1d37aed5792c28685068ec41e2; https://forum.rukovoditel.net/viewtopic.php?f=19&t=2760
CVE: CVE-2021-20228
Published: 2021-04-29
Description: A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1925002; https://github.com/ansible/ansible/pull/73487; https://www.debian.org/security/2021/dsa-4950
CVE: CVE-2021-20294
Published: 2021-04-29
Description: A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1943533; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2021-25810
Published: 2021-04-29
Description: Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Stored%20XSS.md; https://www.mercurycom.com.cn/product-521-1.html; https://www.mercusys.com/en/
CVE: CVE-2021-25811
Published: 2021-04-29
Description: MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the POST listen_http_lan parameter. Upon subsequent device restarts after this vulnerability is exploted the device will not be able to access the webserver unless the listen_http_lan parameter to uhttpd.json is manually fixed.
CVSS Score: 7.5 (HIGH)
References: https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Denial%20of%20Service.md; https://www.mercurycom.com.cn/product-521-1.html; https://www.mercusys.com/en/
CVE: CVE-2021-25812
Published: 2021-04-29
Description: Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection.md; https://www.zhipinmall.com/prodetail?id=1266#skuId=3020
CVE: CVE-2021-27802
Published: 2021-04-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-24177. Reason: This candidate is a duplicate of CVE-2021-24177. Notes: All CVE users should reference CVE-2021-24177 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2021-29350
Published: 2021-04-29
Description: SQL injection in the getip function in conn/function.php in 发货100-设计素材下载系统 1.1 allows remote attackers to inject arbitrary SQL commands via the X-Forwarded-For header to admin/product_add.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/XD-519/Doc/blob/main/sql%20injection.md; https://github.com/XD-519/Doc/blob/main/sql%20injection.md
CVE: CVE-2021-30227
Published: 2021-04-29
Description: Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/emlog/emlog/issues/79; https://github.com/emlog/emlog/issues/79
CVE: CVE-2021-30228
Published: 2021-04-29
Description: The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlink_proc_enable parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection2.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30229
Published: 2021-04-29
Description: The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dm_enable, AppKey, or Pwd parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection3.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30230
Published: 2021-04-29
Description: The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection5.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30231
Published: 2021-04-29
Description: The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the bssaddr, abiaddr, devtoken, devid, elinksync, or elink_proc_enable parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection4.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30232
Published: 2021-04-29
Description: The api/ZRIGMP/set_IGMP_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the IGMP_PROXY_WAN_CONNECT parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection6.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30233
Published: 2021-04-29
Description: The api/ZRIptv/setIptvInfo interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iptv_vlan parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection8.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2021-30234
Published: 2021-04-29
Description: The api/ZRIGMP/set_MLD_PROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the MLD_PROXY_WAN_CONNECT parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://iot.10086.cn/?l=en-us; https://github.com/pokerfacett/MY_REQUEST/blob/master/China%20Mobile%20An%20Lianbao%20WF-1%20router%20Command%20Injection7.md; https://www.cnvd.org.cn/flaw/show/CNVD-2021-03520
CVE: CVE-2020-21101
Published: 2021-04-29
Description: Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add Asset' page via manipulation of a 'URL' field, which could let a remote malicious user execute arbitrary code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Screenly/screenly-ose/issues/1254; https://github.com/Screenly/screenly-ose/issues/1254
CVE: CVE-2020-21452
Published: 2021-04-29
Description: An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/qq[PII_REDACTED]/tyq; https://github.com/qq[PII_REDACTED]/tyq
CVE: CVE-2020-35430
Published: 2021-04-29
Description: SQL Injection in com/inxedu/OS/edu/controller/letter/AdminMsgSystemController in Inxedu v2.0.6 via the ids parameter to admin/letter/delsystem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/inxeduopen/inxedu/issues/I294XL; https://gitee.com/inxeduopen/inxedu/issues/I294XL
CVE: CVE-2021-21415
Published: 2021-04-29
Description: Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Prisma VS Code extension older than 2.20.0. If a custom binary path for the Prisma format binary is set in VS Code Settings, for example by downloading a project that has a .vscode/settings.json file that sets a value for "prismaFmtBinPath". That custom binary is executed when auto-formatting is triggered by VS Code or when validation checks are triggered after each keypress on a *.prisma file. Fixed in versions 2.20.0 and 20.0.27. As a workaround users can either edit or delete the `.vscode/settings.json` file or check if the binary is malicious and delete it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/prisma/language-tools/pull/750; https://github.com/prisma/language-tools/security/advisories/GHSA-4rf9-43m7-x828; https://marketplace.visualstudio.com/items?itemName=Prisma.prisma
CVE: CVE-2021-21417
Published: 2021-04-29
Description: fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/FluidSynth/fluidsynth/issues/808; https://github.com/FluidSynth/fluidsynth/pull/810; https://github.com/FluidSynth/fluidsynth/security/advisories/GHSA-6fcq-pxhc-jxc9
CVE: CVE-2021-30048
Published: 2021-04-29
Description: Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read arbitrary files via the filePath parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/201206030/novel-plus/issues/39; https://www.exploit-db.com/exploits/49724; https://github.com/201206030/novel-plus/issues/39
CVE: CVE-2021-31417
Published: 2021-04-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12131.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-426/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31418
Published: 2021-04-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12221.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-429/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31419
Published: 2021-04-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12136.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-427/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31420
Published: 2021-04-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12220.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-428/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31421
Published: 2021-04-29
Description: This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete arbitrary files in the context of the hypervisor. Was ZDI-CAN-12129.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-425/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31422
Published: 2021-04-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000e virtual device. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12527.
CVSS Score: 7.5 (HIGH)
CWE: CWE-367, CWE-367, CWE-667
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-430/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31423
Published: 2021-04-29
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12528.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-908
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-431/; https://kb.parallels.com/en/125013
CVE: CVE-2021-31424
Published: 2021-04-29
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Open Tools Gate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12848.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-21-434/; https://kb.parallels.com/en/125013