CVE-2011-4756

CVE-2011-4756 affects Parallels Plesk Small Business Panel 10.2.0. The cookie Set-Cookie header does not include the HttpOnly flag, enabling potential script access to cookies used by domains/sitebuilder_edit.php and related files, which could expose sensitive information. The connected documents...

CVE-2011-4856

The CVE concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel sends incorrect Content-Type headers for certain resources. This creates an interpretation conflict involving admin/health/parameters and other files, which could allow remote attackers to achieve an unspecifi...

CVE-2011-4848

The CVE-2011-4848 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel erroneously places a submitted password inside an HTTP response body, enabling remote attackers to obtain sensitive information by sniffing the network. Documented in NVD, the impact is information d...

CVE-2011-4851

The CVE-2011-4851 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel generates a password form field without disabling autocomplete, enabling attackers to bypass authentication on unattended workstations, as demonstrated by forms in server/google-tools/ and other file...

CVE-2011-4743

The CVE-2011-4743 entry concerns Parallels Plesk Panel 10.2.0, build 20110407.20, where the Control Panel omits the Content-Type header’s charset parameter for certain resources. This could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involving sm...

CVE-2011-4849

The CVE-2011-4849 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel does not set the Secure flag on cookies during HTTPS sessions. This can allow an attacker to capture the cookies by intercepting HTTP traffic, as demonstrated by cookies used by help.php and oth...

CVE-2011-4777

CVE-2011-4777 affects Parallels Plesk Panel (Site Editor/SiteBuilder) 10.4.4_build20111103.18. The vulnerability is a Cross-site Scripting (XSS) flaw in the Site Editor that allows injection of arbitrary script/HTML via the login parameter to preferences.html. Affected component: Site Editor in P...

CVE-2011-4740

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive...

CVE-2011-4730

The vulnerability CVE-2011-4730 affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically its Server Administration Panel. The underlying issue is that the password form field is generated without disabling the browser autocomplete feature, which can allow an attacker to bypass authen...

CVE-2011-4757

Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain other files...

CVE-2011-4753

CVE-2011-4753 corresponds to multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0. The issue affects PHP-based input handling in domains like sitebuilder_edit.php and other files, enabling remote attackers to inject SQL commands through crafted input. The NVD and ...

CVE-2011-4758

Parallels Plesk Small Business Panel 10.2.0 is affected by an issue where cleartext password input over HTTP can allow remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and related files. This CVE (CVE-2011-4758) is documented across mu...

CVE-2011-4737

The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...

CVE-2011-4750

Multiple cross-site scripting XSS vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Default.aspx and certain other files...

CVE-2011-4854

The CVE-2011-4854 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel does not ensure that Content-Type HTTP headers match the Content-Type data in HTML META elements, potentially allowing remote attackers to trigger an interpretation conflict involving get_enabled_prod...

CVE-2011-4728

The CVE-2011-4728 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18, where the Server Administration Panel does not set the secure flag on a cookie during HTTPS sessions. This allows an attacker to capture the cookie by probing or intercepting traffic in an HTTP context, as demonstra...

CVE-2011-4742

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrat...

CVE-2011-4847

CVE-2011-4847 describes an SQL injection in the Control Panel of Parallels Plesk Panel 10.4.4_build20111103.18. The vulnerability can be exploited remotely by sending a crafted certificateslist cookie to notification@/, potentially allowing arbitrary SQL execution with partial confidentiality/int...

CVE-2011-4738

The CVE-2011-4738 entry describes a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20 where the HTTPOnly flag is missing on a Set-Cookie header. This absence allows remote attackers to access cookie values via script, potentially exposing sensitive information such as data used by g...

CVE-2011-4776

CVE-2011-4776 describes multiple XSS vulnerabilities in Parallels Plesk Panel 10.4.4_build20111103.18. The issue allows remote attackers to inject arbitrary JavaScript/HTML via crafted input to PHP scripts, demonstrated via admin/update/settings/ and other files in the Control Panel. The provided...