CVE-2011-4847

SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/...

CVE-2011-4737

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/...

CVE-2011-4748

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as...

CVE-2011-4738

The CVE-2011-4738 entry describes a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20 where the HTTPOnly flag is missing on a Set-Cookie header. This absence allows remote attackers to access cookie values via script, potentially exposing sensitive information such as data used by g...

CVE-2011-4759

Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading 1...

CVE-2011-4728

The CVE-2011-4728 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18, where the Server Administration Panel does not set the secure flag on a cookie during HTTPS sessions. This allows an attacker to capture the cookie by probing or intercepting traffic in an HTTP context, as demonstra...

CVE-2011-4739

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/my-profile a...

CVE-2011-4767

The Site Editor aka SiteBuilder feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a...

CVE-2011-4756

Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilderedit.p...

CVE-2011-4753

Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilderedit.php and certain other files...

CVE-2011-4735

Multiple cross-site scripting XSS vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files...

PT-2011-5096 · Parallels · Parallels Plesk Small Business Panel

Name of the Vulnerable Software and Affected Versions: Parallels Plesk Small Business Panel version 10.2.0 Description: The Site Editor feature in Parallels Plesk Small Business Panel allows remote attackers to obtain ASP source code via a direct request to "wysiwyg/fckconfig.js". Note that the...

Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability Release Date: ============= 2011-07-12 Vulnerability Laboratory ID VL-ID: ==================================== 152 Product & Service Introduction: =============================== Parallels Plesk Panel...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk 8.2 URL Redirection

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability 1. OVERVIEW The Plesk versions from 7.0 to 8.2 are vulnerable to Open URL Redirection when "Enable [email protected]" access format, a new feature introduced in Plesk 7.0, is enabled in user preferences. 2. BACKGROUND Parallels Plesk...

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability 1. OVERVIEW The Plesk versions from 7.0 to 8.2 are vulnerable to Open URL Redirection when "Enable [email protected]" access format, a new feature introduced in Plesk 7.0, is enabled in user preferences. 2. BACKGROUND Parallels Plesk...

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date:...

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities

XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date: 2010-09-17 Author : David Hoyt – http://cloudscan.me Contact : [email protected] Home...

Plesk Small Business Manager 10.2 Cross Site Scripting / SQL Injection

XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date: 2010-09-17 Author : David Hoyt – http://cloudscan.me Contact : [email protected] Home...