How severe is CVE-2022-34890?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.3 out of 10.

What type of vulnerability is CVE-2022-34890?

This is classified as CWE-822, which is a common weakness in software security.

CVE-2022-34890 - HIGH Severity | CVSS 7.3

Vulnerability Description

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-16653.

Related Vulnerabilities

CVE-2024-43529

HIGH

CVSS:7.3(High)

Windows Print Spooler Elevation of Privilege Vulnerability

CWE-8222024

CVE-2024-25078

HIGH

CVSS:7.4(High)

A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, ke...

CWE-8222024

CVE-2024-27353

HIGH

CVSS:7.4(High)

A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kern...

CWE-8222024

CVE-2017-12719

HIGH

CVSS:7.5(High)

An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dereference a pointer within the program caus...

CWE-8222017

CVE-2017-16728

HIGH

CVSS:7.5(High)

An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid...

CWE-8222017

CVE-2020-1899

HIGH

CVSS:7.5(High)

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were stat...

CWE-8222020