CVE-2011-4853

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files...

CVE-2011-4743

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files...

CVE-2011-4736

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in loginup.php3 and certain other files...

CVE-2011-4854

The CVE-2011-4854 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel does not ensure that Content-Type HTTP headers match the Content-Type data in HTML META elements, potentially allowing remote attackers to trigger an interpretation conflict involving get_enabled_prod...

CVE-2011-4847

CVE-2011-4847 describes an SQL injection in the Control Panel of Parallels Plesk Panel 10.4.4_build20111103.18. The vulnerability can be exploited remotely by sending a crafted certificateslist cookie to notification@/, potentially allowing arbitrary SQL execution with partial confidentiality/int...

CVE-2011-4852

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by...

CVE-2011-4850

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by...

CVE-2011-4855

The CVE-2011-4855 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel omits the Content-Type header charset parameter for certain resources. This omission could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involvi...

CVE-2011-4776

CVE-2011-4776 describes multiple XSS vulnerabilities in Parallels Plesk Panel 10.4.4_build20111103.18. The issue allows remote attackers to inject arbitrary JavaScript/HTML via crafted input to PHP scripts, demonstrated via admin/update/settings/ and other files in the Control Panel. The provided...

CVE-2011-4853

CVE-2011-4853 affects Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel exposes an RFC 1918 (private) IP address within a web page, which allows remote attackers to read the page and potentially access sensitive information. Demonstrated by access to smb/user/list-data/items-per-pa...

CVE-2011-4848

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under...

CVE-2011-4855

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

Vulnerabilities in D-Link DSL-500T ADSL Router

Hello 3APA3A! I want to warn you about security vulnerabilities in D-Link DSL-500T ADSL Router. These are Predictable Resource Location, Brute Force and Cross-Site Request Forgery vulnerabilities. This is my first advisory from series of advisories about vulnerabilities in D-Link products...

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Easy Hosting Control Panel is prone to a security-bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Easy Hosting Control Panel is prone to a security-bypass vulnerability. Attackers could exploit the issue to add arbitrary FTP accounts to the affected application. Easy Hosting Control Panel versions 0.29.10 up to and including 0.29.13 are vulnerable. OpenVAS Vulnerability Test $Id:...

Easy Hosting Control Panel - Admin Authentication Bypass

Easy Hosting Control Panel - Admin Authentication Bypass Exploit Title: Easy Hosting Control Panel Admin Auth Bypass Google Dork: inurl:/ehcp/?op=applyfordomainaccount Date: 10/04/2011 Author: Jasman Software Link: https://launchpad.net/ehcp & http://www.ehcp.net Version: 0.29.10 - 0.29.13 Tested...

Easy Hosting Control Panel Authentication Bypass

Exploit Title: Easy Hosting Control Panel Admin Auth Bypass Google Dork: inurl:/ehcp/?op=applyfordomainaccount Date: 10/04/2011 Author: Jasman Software Link: https://launchpad.net/ehcp & http://www.ehcp.net Version: 0.29.10 - 0.29.13 Tested on: Ubuntu, Debian + Description Easy Hosting Control...

Easy Hosting Control Panel - Admin Authentication Bypass

Exploit Title: Easy Hosting Control Panel Admin Auth Bypass Google Dork: inurl:/ehcp/?op=applyfordomainaccount Date: 10/04/2011 Author: Jasman Software Link: https://launchpad.net/ehcp & http://www.ehcp.net Version: 0.29.10 - 0.29.13 Tested on: Ubuntu, Debian + Description Easy Hosting Control...

Easy Hosting Control Panel Admin Auth Bypass

Exploit for php platform in category web applications Exploit Title: Easy Hosting Control Panel Admin Auth Bypass Google Dork: inurl:/ehcp/?op=applyfordomainaccount Date: 10/04/2011 Author: Jasman Software Link: https://launchpad.net/ehcp & http://www.ehcp.net Version: 0.29.10 - 0.29.13 Tested on...

Strato Server ACP - Persistent DOM XSS Vulnerabilities

Document Title: =============== Strato Server ACP - Persistent DOM XSS Vulnerabilities Release Date: ============= 2011-08-24 Vulnerability Laboratory ID VL-ID: ==================================== 141 Product & Service Introduction: =============================== Control Panel of Strato Hosting...