CVE-2011-4754

CVE-2011-4754 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0. The issue allows remote attackers to inject arbitrary web script or HTML through crafted input to a PHP script, with examples including smb/app/available/id/apscatalog/...

CVE-2011-4735

CVE-2011-4735 involves multiple XSS vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The flaws allow remote attackers to inject arbitrary web scripts or HTML via crafted input to a PHP script, with examples including smb/user/create. The affected product is ...

CVE-2011-4757

Parallels Plesk Small Business Panel 10.2.0 is affected: a password form field is generated without disabling autocomplete, enabling possible authentication bypass on unattended workstations through forms such as smb/auth. Root cause is autocomplete not being disabled on the password field. The c...

CVE-2011-4761

The CVE-2011-4761 entry concerns Parallels Plesk Small Business Panel 10.2.0, where the Content-Type header omits the charset parameter for certain resources (notably involving domains/sitebuilder_edit.php). This omission could allow remote attackers to achieve an unspecified impact via an interp...

CVE-2011-4759

Parallels Plesk Small Business Panel 10.2.0 is affected by a cross-domain Referer leakage issue. When handling GET requests with specific query strings (e.g., client@1/domain@1/hosting/file-manager/ and related paths), the application generates web pages containing external links, which can allow...

CVE-2011-4755

Parallels Plesk Small Business Panel 10.2.0 is affected by CVE-2011-4755 due to improper validation of string data intended for XML storage. The root cause is parsing of crafted cookies, which can trigger a denial of service (parsing error) and potentially other unspecified impact. The vulnerabil...

CVE-2011-4741

The CVE-2011-4741 entry pertains to Parallels Plesk Panel 10.2.0 build 20110407.20. The Control Panel includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading the page at client@2/domain@1/hosting/aspdotnet/. The...

CVE-2011-4749

Affected software: Parallels Plesk Panel 10.3.1_build1013110726.09. The vulnerability is that the billing system’s password field is generated with autocomplete enabled, enabling bypass of authentication by a user with an unattended workstation, as demonstrated on forms under admin/index.php/defa...

CVE-2011-4745

CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...

CVE-2011-4731

The CVE-2011-4731 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically the Server Administration Panel. A web page inadvertently includes an RFC 1918 internal IP address, enabling remote attackers to read the page and potentially obtain sensitive information (e.g., via admi...

CVE-2011-4726

Parallels Plesk Panel 10.2.0_build1011110331.18 contains multiple XSS vulnerabilities in the Server Administration Panel. The issue allows remote attackers to inject arbitrary web script or HTML via crafted input to PHP scripts, demonstrated by inputs to files such as admin/health/ . Root cause c...

CVE-2011-4748

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as...

CVE-2011-4848

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under...

CVE-2011-4855

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

CVE-2011-4768

The Site Editor aka SiteBuilder feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving...

CVE-2011-4746

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses...

CVE-2011-4764

Multiple cross-site scripting XSS vulnerabilities in the Site Editor aka SiteBuilder feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain oth...

CVE-2011-4756

Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilderedit.p...

CVE-2011-4850

The CVE-2011-4850 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the HTTPOnly flag is absent in a Set-Cookie header used by cookies (e.g., in help.php), allowing remote attackers to access cookie data via script. This could partially expose sensitive information as described. ...

CVE-2011-4759

Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading 1...