CVE-2011-4745

CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...

CVE-2011-4743

The CVE-2011-4743 entry concerns Parallels Plesk Panel 10.2.0, build 20110407.20, where the Control Panel omits the Content-Type header’s charset parameter for certain resources. This could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involving sm...

CVE-2011-4742

The CVE-2011-4742 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20: the Control Panel exposes web pages containing e-mail addresses not intended for that deployment, enabling remote attackers to obtain potentially sensitive information by reading pages such as smb/user/list. Documents...

CVE-2011-4740

The CVE-2011-4740 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is described as a cross-domain Referer leakage: the Control Panel generates web pages containing external links in response to GET requests with specific query strings (e.g., smb/app/search-data/catalogId/ma...

CVE-2011-4737

The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...

CVE-2011-4734

CVE-2011-4734 describes multiple SQL injection vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The underlying vulnerability is in input handling for PHP scripts, with inputs such as those in file-manager/ and related components allowing a remote attacker to...

CVE-2011-4731

The CVE-2011-4731 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically the Server Administration Panel. A web page inadvertently includes an RFC 1918 internal IP address, enabling remote attackers to read the page and potentially obtain sensitive information (e.g., via admi...

CVE-2011-4727

The CVE-2011-4727 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18: the Server Administration Panel mishandles string data intended for XML storage, enabling a remote attacker to trigger a parsing error via crafted REST URL parameters (e.g., to admin/ and related files), resulting in...

CVE-2011-4855

The CVE-2011-4855 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel omits the Content-Type header charset parameter for certain resources. This omission could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involvi...

CVE-2011-4852

The CVE-2011-4852 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and related files, enabling cross-domain referer leakage. This can allow rem...

CVE-2011-4848

The CVE-2011-4848 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel erroneously places a submitted password inside an HTTP response body, enabling remote attackers to obtain sensitive information by sniffing the network. Documented in NVD, the impact is information d...

CVE-2011-4776

CVE-2011-4776 describes multiple XSS vulnerabilities in Parallels Plesk Panel 10.4.4_build20111103.18. The issue allows remote attackers to inject arbitrary JavaScript/HTML via crafted input to PHP scripts, demonstrated via admin/update/settings/ and other files in the Control Panel. The provided...

CVE-2011-4766

The CVE-2011-4766 entry concerns Parallels Plesk Small Business Panel 10.2.0, specifically the Site Editor/SiteBuilder and the file wysiwyg/fckconfig.js. The claim is that remote attackers could obtain ASP source code via direct access to that file; however, multiple sources note this is disputed...

CVE-2011-4764

CVE-2011-4764 describes multiple XSS vulnerabilities in the Site Editor (SiteBuilder) feature of Parallels Plesk Small Business Panel 10.2.0 . The issues allow remote attackers to inject arbitrary web script or HTML via crafted input in a PHP script, demonstrated through Wizard/Edit/Modules/Image...

CVE-2011-4762

CVE-2011-4762 affects Parallels Plesk Small Business Panel 10.2.0. The issue is that it sends incorrect Content-Type headers for certain resources, potentially enabling a remote attacker to exploit an interpretation conflict involving smb/app/top-categories-data/ and other files, with unspecified...

CVE-2011-4761

The CVE-2011-4761 entry concerns Parallels Plesk Small Business Panel 10.2.0, where the Content-Type header omits the charset parameter for certain resources (notably involving domains/sitebuilder_edit.php). This omission could allow remote attackers to achieve an unspecified impact via an interp...

CVE-2011-4758

Parallels Plesk Small Business Panel 10.2.0 is affected by an issue where cleartext password input over HTTP can allow remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and related files. This CVE (CVE-2011-4758) is documented across mu...

CVE-2011-4756

CVE-2011-4756 affects Parallels Plesk Small Business Panel 10.2.0. The cookie Set-Cookie header does not include the HttpOnly flag, enabling potential script access to cookies used by domains/sitebuilder_edit.php and related files, which could expose sensitive information. The connected documents...

CVE-2011-4755

Parallels Plesk Small Business Panel 10.2.0 is affected by CVE-2011-4755 due to improper validation of string data intended for XML storage. The root cause is parsing of crafted cookies, which can trigger a denial of service (parsing error) and potentially other unspecified impact. The vulnerabil...

CVE-2011-4753

CVE-2011-4753 corresponds to multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0. The issue affects PHP-based input handling in domains like sitebuilder_edit.php and other files, enabling remote attackers to inject SQL commands through crafted input. The NVD and ...