Design/Logic Flaw

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

CVE-2021-38148

Obsidian up to version 0.12.11 does not require user confirmation for non-http/https URLs, per CVE-2021-38148. The root cause is a missing user consent check when handling non-http/https links, which can lead to unintended navigation or loading of external content. The CVSS data indicates high im...

PT-2021-21968

Name of the Vulnerable Software and Affected Versions: Obsidian versions prior to 0.12.12 Description: The issue concerns a lack of user confirmation for non-http/https URLs. Recommendations: For versions prior to 0.12.12, update to version 0.12.12 or later to resolve the issue...

CVE-2021-38148: Undefined Security Weakness

Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs...

Obsidian 安全漏洞

Plesk Obsidian is a hosting control panel from the Swiss company Plesk. Obsidian suffers from a security vulnerability that stems from not requiring the user to validate a non-http https url...

Plesk Obsidian Cross-Site Scripting Vulnerability

Plesk Obsidian is a mainframe control panel from the Swiss company Plesk. A cross-site scripting vulnerability exists in Plesk Obsidian version 18.0.17. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability ...

CVE-2020-11583

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

CVE-2020-11583

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

Cross site scripting

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

CVE-2020-11583

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

CVE-2020-11583

CVE-2020-11583 affects Plesk Obsidian 18.0.17 with a GET-based reflected XSS. The vulnerability allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. The available connected documents corroborate a client-side data handling flaw in the Plesk Obsidia...

CVE-2020-11583: Improper Neutralization of Input During Web Page Generation

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

PT-2020-12699

Name of the Vulnerable Software and Affected Versions Plesk Obsidian version 18.0.17 Description A GET-based XSS reflected issue allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. This enables attackers to execute malicious code on the victim's...

Plesk/myLittleAdmin - ViewState .NET Deserialization Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule VIEWSTATEGENERATOR = 'CA0B0334'.freeze VIEWSTATEVALIDATIONKEY = "\x5c\x7e\xef\x66\x50\x63\x9d\x2c\xb8\xfa\xa0\xda\x36\xaf\x24\x45\x2d\xcf" ...

Plesk / myLittleAdmin ViewState .NET Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule VIEWSTATEGENERATOR = 'CA0B0334'.freeze VIEWSTATEVALIDATIONKEY = "\x5c\x7e\xef\x66\x50\x63\x9d\x2c\xb8\xfa\xa0\xda\x36\xaf\x24\x45\x2d\xcf" ...

Plesk/myLittleAdmin ViewState .NET Deserialization

This module exploits a ViewState .NET deserialization vulnerability in web-based MS SQL Server management tool myLittleAdmin, for version 3.8 and likely older versions, due to hardcoded parameters in the web.config file for ASP.NET. Popular web hosting control panel Plesk offers myLittleAdmin as ...