rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-27294 
Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit malicious Javascript as the description for a calendar event, which would then be executed in other users' browsers if they browse to that event. This could result in stealing session tokens from users with higher permission levels or forcing users to make actions without their knowledge.
Problem types: description: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting)
Affected products: vendor: n/a
product: OpenCATS
Published: 2023-02-28T00:00:00.000Z
CVE-2023-27295 
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: n/a
product: OpenCATS
Published: 2023-02-28T00:00:00.000Z
CVE-2023-27296 Apache InLong: JDBC Deserialization Vulnerability in InLong
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.

It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.

This issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.



[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html

 https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html 

[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 




Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: escape Wang
Published: 2023-03-27T14:10:32.785Z
CVE-2023-27298 
Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: WULT software maintained by Intel(R)
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:17:26.434Z
CVE-2023-27300 
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-02-14T13:37:47.252Z
CVE-2023-27301 
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.2
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
Published: 2024-02-14T13:37:46.150Z
CVE-2023-27303 
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-02-14T13:37:48.307Z
CVE-2023-27304 
Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin.
Problem types: description: Improper authorization
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2023-05-23T00:00:00.000Z
CVE-2023-27305 
Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: n/a
product: Intel(R) Arc(TM) Control software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-11-14T19:04:21.686Z
CVE-2023-27306 
Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-665
description: Improper Initialization
Affected products: vendor: n/a
product: Intel(R) Optane(TM) SSD products
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2023-11-14T19:04:56.952Z
CVE-2023-27307 
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-02-14T13:37:46.706Z
CVE-2023-27308 
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
Published: 2024-02-14T13:37:45.069Z
CVE-2023-27309 
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions for specific write queries. This could allow an authenticated remote attacker to perform unauthorized actions.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Siemens
product: RUGGEDCOM CROSSBOW
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseScore: 5
baseSeverity: MEDIUM
Published: 2023-03-14T09:31:57.134Z
CVE-2023-27310 
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to otherwise non-privileged user accounts.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Siemens
product: RUGGEDCOM CROSSBOW
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 6.6
baseSeverity: MEDIUM
Published: 2023-03-14T09:31:58.178Z
CVE-2023-27311 
NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the fix requires redeploying a fresh Connector.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Information Disclosure Vulnerability in NetApp BlueXP Connector
Published: 2023-05-26T00:00:00.000Z
CVE-2023-27312 Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere 
SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are 
susceptible to a vulnerability which may allow authenticated 
unprivileged users to modify email and snapshot name settings within the
 VMware vSphere user interface.



Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: NetApp
product: SnapCenter Plugin for VMware vSphere
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2023-10-12T18:19:16.530Z
CVE-2023-27313 Privilege Escalation Vulnerability in SnapCenter
SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a 
vulnerability which may allow an authenticated unprivileged user to gain
 access as an admin user.


Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: NetApp
product: SnapCenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2023-10-12T18:22:28.435Z
CVE-2023-27314 Denial of Service Vulnerability in ONTAP 9
ONTAP 9 versions prior to 9.8P19, 9.9.1P16, 9.10.1P12, 9.11.1P8, 
9.12.1P2 and 9.13.1 are susceptible to a vulnerability which could allow
 a remote unauthenticated attacker to cause a crash of the HTTP service.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: NetApp
product: ONTAP 9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-10-12T18:26:47.593Z
CVE-2023-27315 Information Disclosure Vulnerability in SnapGathers 
SnapGathers versions prior to 4.9 are susceptible to a vulnerability 
which could allow a local authenticated attacker to discover plaintext 
domain user credentials
Problem types: cwe_id: CWE-256
description: CWE-256
Affected products: vendor: NetApp
product: SnapGathers 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2023-10-12T13:56:38.513Z
CVE-2023-27316 Privilege Escalation Vulnerability in SnapCenter
SnapCenter versions 4.8 through 4.9 are susceptible to a 
vulnerability which may allow an authenticated SnapCenter Server user to
 become an admin user on a remote system where a SnapCenter plug-in has 
been installed.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: NetApp
product: SnapCenter
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-10-12T21:04:47.473Z
CVE-2023-27317 Information Disclosure Vulnerability in ONTAP 9 
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a 
vulnerability which will cause all SAS-attached FIPS 140-2 drives to 
become unlocked after a system reboot or power cycle or a single 
SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This
 could lead to disclosure of sensitive information to an attacker with 
physical access to the unlocked drives. 


Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: NetApp
product: ONTAP 9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-12-15T22:59:11.093Z
CVE-2023-27318 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) 
StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 
11.6.0.13 are susceptible to a Denial of Service (DoS) vulnerability. A 
successful exploit could lead to a crash of the Local Distribution 
Router (LDR) service.


Problem types: cwe_id: CWE-248
description: CWE-248
Affected products: vendor: NetApp
product: StorageGRID (formerly StorageGRID Webscale) 
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-02-05T20:35:27.521Z
CVE-2023-27319  CVE-2023-27319 Information Disclosure Vulnerability in ONTAP Mediator
ONTAP Mediator versions prior to 1.7 are susceptible to a 
vulnerability that can allow an unauthenticated attacker to enumerate 
URLs via REST API.


Problem types: cwe_id: CWE-209
description: CWE-209
Affected products: vendor: NetApp
product: ONTAP Mediator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2023-12-21T21:15:51.018Z
CVE-2023-27320 
Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-28T00:00:00.000Z
CVE-2023-27321 OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability
OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
Affected products: vendor: OPC Foundation
product: UA .NET Standard
default_status: unknown
Published: 2024-05-07T22:55:01.898Z
CVE-2023-27322 Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Parallels Service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-17751.
Problem types: cwe_id: CWE-665
description: CWE-665: Improper Initialization
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:48.211Z
CVE-2023-27323 Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18150.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:48.942Z
CVE-2023-27324 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18229.
Problem types: cwe_id: CWE-665
description: CWE-665: Improper Initialization
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:49.633Z
CVE-2023-27325 Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability
Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.

The specific flaw exists within the Updater service. The issue results from the lack of proper initialization of environment variables. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.
. Was ZDI-CAN-18253.
Problem types: cwe_id: CWE-665
description: CWE-665: Improper Initialization
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:50.329Z
CVE-2023-27326 Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability
Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system.
. Was ZDI-CAN-18933.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:51.064Z
CVE-2023-27327 Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18964.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:51.773Z
CVE-2023-27328 Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability
Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.

The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of a user-supplied string before using it to construct an XML document. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-19187.
Problem types: cwe_id: CWE-91
description: CWE-91: XML Injection
Affected products: vendor: Parallels
product: Desktop
default_status: unknown
Published: 2024-05-03T01:55:52.492Z