CVE-2011-4851

The CVE-2011-4851 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel generates a password form field without disabling autocomplete, enabling attackers to bypass authentication on unattended workstations, as demonstrated by forms in server/google-tools/ and other file...

CVE-2011-4736

The CVE-2011-4736 issue affects Parallels Plesk Panel (Control Panel) version 10.2.0 build 20110407.20, where cleartext passwords are transmitted over HTTP in login_up.php3 and related files. Root cause: credentials sent unencrypted, enabling network sniffing. Impact is limited to exposed authent...

CVE-2011-4734

CVE-2011-4734 describes multiple SQL injection vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The underlying vulnerability is in input handling for PHP scripts, with inputs such as those in file-manager/ and related components allowing a remote attacker to...

CVE-2011-4856

The CVE concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel sends incorrect Content-Type headers for certain resources. This creates an interpretation conflict involving admin/health/parameters and other files, which could allow remote attackers to achieve an unspecifi...

CVE-2011-4729

CVE-2011-4729 : The Parallels Plesk Panel 10.2.0_build1011110331.18 Server Administration Panel fails to set the HTTPOnly flag on cookies (notably those used by login_up.php3 and other files). This exposes cookies to access via client-side scripts, leading to potential disclosure of sensitive inf...

CVE-2011-4739

CVE-2011-4739 affects Parallels Plesk Panel Control Panel version 10.2.0 build 20110407.20. The underlying issue is that the password form field is generated without disabling autocomplete, which can allow remote attackers to bypass authentication by exploiting an unattended workstation. Demonstr...

CVE-2011-4849

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php a...

CVE-2011-4754

Multiple cross-site scripting XSS vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files...

CVE-2011-4743

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files...

CVE-2011-4776

CVE-2011-4776 describes multiple XSS vulnerabilities in Parallels Plesk Panel 10.4.4_build20111103.18. The issue allows remote attackers to inject arbitrary JavaScript/HTML via crafted input to PHP scripts, demonstrated via admin/update/settings/ and other files in the Control Panel. The provided...

CVE-2011-4852

The CVE-2011-4852 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and related files, enabling cross-domain referer leakage. This can allow rem...

CVE-2011-4851

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tool...

CVE-2011-4725

Technical details (affected versions, root cause, exploit specifics, and fixes) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2011-4747

Parallels Plesk Panel 10.3.1_build1013110726.09 is affected by CVE-2011-4747 due to a flaw in SSL configuration that allows use of weak ciphers through a crafted CipherSuite list, enabling remote attackers to defeat cryptographic protections. The vulnerability targets the billing system component...

CVE-2011-4855

The CVE-2011-4855 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel omits the Content-Type header charset parameter for certain resources. This omission could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involvi...

CVE-2011-4736

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in loginup.php3 and certain other files...

CVE-2011-4760

Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by...

CVE-2011-4732

The CVE-2011-4732 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18. The issue is that the Server Administration Panel omits the Content-Type header's charset parameter for certain resources, which may enable remote attackers to cause an unspecified impact via an interpretation confl...

CVE-2011-4725

Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by loginup.php3 and certain other files...

CVE-2011-4742

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrat...