CVE-2020-35710

Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.

• CWE-200

• https://twitter.com/amadapa/status/1342407005110218753Third Party Advisory
• https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.htmlExploit, Third Party Advisory
• https://twitter.com/amadapa/status/1342407005110218753Third Party Advisory
• https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.htmlExploit, Third Party Advisory

Published

Dec 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35705Daybyday 2.1.0 allows stored XSS via the Name parameter to t…5.4
• CVE-2020-35706Daybyday 2.1.0 allows stored XSS via the Title parameter to …5.4
• CVE-2020-35707Daybyday 2.1.0 allows stored XSS via the Company Name parame…5.4
• CVE-2020-35708phpList 3.5.9 allows SQL injection by admins who provide a c…7.2
• CVE-2020-35709bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php fi…4.9
• CVE-2020-3571A vulnerability in the ICMP ingress packet processing of Cis…8.6
• CVE-2020-35711An issue has been discovered in the arc-swap crate before 0.…7.5
• CVE-2020-35712Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some…9.8
• CVE-2020-35713Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remot…9.8
• CVE-2020-35714Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote…8.8
• CVE-2020-35715Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remot…8.8
• CVE-2020-35716Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remot…7.5