CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45894
https://notcve.org/view.php?id=CVE-2023-45894
The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques. El servidor de aplicaciones remotas en Parallels RAS anterior a 19.2.23975 no segmenta las aplicaciones virtualizadas del servidor, lo que permite a un atacante remoto lograr la ejecución remota de código mediante técnicas de ruptura de quiosco estándar. • https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md •
CVSS: 9.9EPSS: 1%CPEs: 1EXPL: 1CVE-2020-15860
https://notcve.org/view.php?id=CVE-2020-15860
Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application, despite the affected application not being published. In addition, it was discovered that it is possible to access any host in the internal domain, even if it has no published applications or the mentioned host is no longer associated with that server farm. Parallels Remote Application Server (RAS) versión 17.1.1, presenta un Error de Lógica de Negocios que causa una ejecución de código remota. Permite a un usuario autenticado ejecutar cualquier aplicación en el sistema operativo backend por medio de la aplicación web, a pesar de que la aplicación afectada no ha sido publicada. • https://kb.parallels.com/en/125112 https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution https://www.parallels.com/products/ras/remote-application-server •