CVE-2020-17402

MEDIUM Year: 2020
CVSS v3 Score
6.5
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-732
View all →

Vulnerability Description

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. By examining a log file, an attacker can disclose a memory address. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11063.

Related Vulnerabilities

CVE-2015-9456

MEDIUM
CVSS:6.5(Medium)

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save...

CWE-7322015

CVE-2017-1000095

MEDIUM
CVSS:6.5(Medium)

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). These allowed circumventing many of the acc...

CWE-7322017

CVE-2017-1000221

MEDIUM
CVSS:6.5(Medium)

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need ...

CWE-7322017

CVE-2017-11437

MEDIUM
CVSS:6.5(Medium)

GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read reposit...

CWE-7322017

CVE-2017-15611

MEDIUM
CVSS:6.5(Medium)

In Octopus before 3.17.7, an authenticated user who was explicitly granted the permission to invite new users (aka UserInvite) can invite users to teams with escalated privileges.

CWE-7322017

CVE-2017-16631

MEDIUM
CVSS:6.5(Medium)

In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Reference (IDOR) in the "Account Password Reset" functionality.

CWE-7322017