CVE-2007-1222

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

Parallels Desktop for Mac before 20070216 implements Drag and Drop by sharing the entire host filesystem as the .psf share, which allows local users of the guest operating system to write arbitrary files to the host filesystem, and execute arbitrary code via launchd by writing a plist file to a LaunchAgents directory.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-12235.0Unspecified vulnerability in Hitachi OSAS/FT/W before 20070223 allows attackers to cause a denial of service (responder control processing h CVE-2007-12245.0Grok Developments NetProxy 4.03 allows remote attackers to bypass URL filtering via a request that omits "http://" from the URL and specifie CVE-2007-122510.0The connection log file implementation in Grok Developments NetProxy 4.03 does not record requests that omit http:// in a URL, which might a CVE-2007-12264.1McAfee VirusScan for Mac (Virex) before 7.7 patch 1 has weak permissions (0666) for /Library/Application Support/Virex/VShieldExclude.txt, w CVE-2007-12276.6VShieldCheck in McAfee VirusScan for Mac (Virex) before 7.7 patch 1 allow local users to change permissions of arbitrary files via a symlink CVE-2007-12284.4IBM DB2 UDB 8.2 before Fixpak 7 (aka fixpack 14), and DB2 9 before Fix Pack 2, on UNIX allows the "fenced" user to access certain unauthoriz CVE-2007-12294.3Cross-site scripting (XSS) vulnerability in the Nullsoft ShoutcastServer 1.9.7 allows remote attackers to inject arbitrary web script or HTM CVE-2007-12305.8Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to i CVE-2007-12314.3Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via CVE-2007-12325.1Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in a SQLiteManag CVE-2007-12337.5PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attackers to execute arbitr CVE-2007-12344.3Multiple cross-site scripting (XSS) vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via (1) the sxYea