CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2013-4878

CVE-2013-4878 affects Parallels Plesk Panel 9.0.x–9.2.x on UNIX and Small Business Panel 10.x on UNIX, due to an improper ScriptAlias directive for phppath that enables remote code execution via crafted requests. Affected versions expose code execution under the web server user; exploitation reli...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

IRC Botnet Leveraging Unpatched Plesk Vulnerability

Researchers have found a botnet exploiting a vulnerability in the Plesk hosting control panel, ramping up calls from experts to upgrade to current versions of the product. A notice on the Plesk command injection vulnerability as well as exploit code was posted last week to the Full Disclosure lis...

Plesk Panel Apache Arbitrary PHP Code Injection

The remote host contains an Apache web server installation that is included with Parallels Plesk Panel and that is affected by a remote PHP code injection vulnerability. Due to an Apache configuration issue, a remote, unauthenticated attacker can exploit this issue by crafting a request allowing...

Parallels Plesk Panel phppath/php vulnerability

Overview Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms are vulnerable to remote code execution. Description Parallels Plesk Panel versions 9.0 - 9.2.3 on Linux platforms may be exploited by a combination of CVE-2012-1823 and the Plesk phppath script alias usage. There have been...

VulnCheck KEV: CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

Plesk 9.5.4 - Remote Command Execution

Plesk 9.5.4 - Remote Command Execution Plesk Apache zeroday / June 2013 discovered & exploited by kingcope this Plesk configuration setting makes it possible: scriptAlias /phppath/ "/usr/bin/" Furthermore this is not cve-2012-1823 because the php interpreter is called directly. no php file is...

Plesk Horde Detection

The remote web server is running Horde, an open source, PHP-based application framework from The Horde Project. This installation was detected on a web server configured with Parallels Plesk Panel, a web hosting control panel. Plesk pre-configures the Horde install with a virtual host such as...

CVE-2013-0133

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

CVE-2013-0132

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

Code injection

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

CVE-2013-0133

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

Design/Logic Flaw

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

CVE-2013-0132

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

CVE-2013-0132

The CVE-2013-0132 entry documents a vulnerability in Parallels Plesk Panel 11.0.9 where the suexec implementation uses a cgi-wrapper whitelist entry that, because suexec does not sanitize environment variables, allows a user-assisted remote attacker to execute arbitrary PHP code via a crafted req...

CVE-2013-0133

CVE-2013-0133 affects Parallels Plesk Panel 11.0.9 (and related versions referenced in the linked sources) where the program /usr/local/psa/admin/sbin/wrapper is vulnerable to an untrusted search path attack. An attacker with local access and PSA administrator rights can cause privilege escalatio...

Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=714 Reward: 3000$ Release Date: ============= 2012-11-01 Vulnerability Laboratory ID VL-ID:...

Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=714 Reward: 3000$ Release Date: ============= 2012-11-01 Vulnerability Laboratory ID VL-ID:...

CVE-2012-5004

Multiple cross-site request forgery CSRF vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for requests that 1 add group plans via admin/groupplans.html or 2 add extra packages via admin/extrapacks/createextrapack.html...