CVE-2011-4731

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files...

CVE-2011-4725

Technical details (affected versions, root cause, exploit specifics, and fixes) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2011-4847

CVE-2011-4847 describes an SQL injection in the Control Panel of Parallels Plesk Panel 10.4.4_build20111103.18. The vulnerability can be exploited remotely by sending a crafted certificateslist cookie to notification@/, potentially allowing arbitrary SQL execution with partial confidentiality/int...

CVE-2011-4737

The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...

CVE-2011-4758

Parallels Plesk Small Business Panel 10.2.0 is affected by an issue where cleartext password input over HTTP can allow remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and related files. This CVE (CVE-2011-4758) is documented across mu...

CVE-2011-4733

The CVE-2011-4733 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18 where the Server Administration Panel sends incorrect Content-Type headers for certain resources. The description indicates an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and ...

CVE-2011-4765

The Site Editor aka SiteBuilder feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated b...

CVE-2011-4762

Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files. NOTE: it is possible th...

CVE-2011-4733

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

CVE-2011-4745

Multiple cross-site scripting XSS vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files...

CVE-2011-4847

SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/...

CVE-2011-4727

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service parsing error or possibly have unspecified other impact via a crafte...

CVE-2011-4747

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 does not prevent the use of weak ciphers for SSL sessions, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a crafted CipherSuite list...

CVE-2011-4759

Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading 1...

CVE-2011-4753

Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilderedit.php and certain other files...

CVE-2011-4726

Multiple cross-site scripting XSS vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files...

CVE-2011-4732

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout...

CVE-2011-4730

The Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in...

CVE-2011-4765

The CVE concerns Parallels Plesk Small Business Panel 10.2.0, where the Site Editor (SiteBuilder) feature fails to set the HTTPOnly flag on a Set-Cookie header. This omission allows scripts to access the cookie, potentially leaking sensitive information via cookies used by Wizard/Edit/Modules/Ima...

CVE-2011-4745

CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...