Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft build 4.0.0-365.6.swsoft and 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag...

CVE-2008-6479

Cross-site request forgery CSRF vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd...

CVE-2008-6478

Cross-site request forgery CSRF vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft build 4.0.0-365.6.swsoft and 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag...

CVE-2008-6479

The CVE-2008-6479 entry describes a CSRF vulnerability affecting Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) in the VZPP web interface. The flaw allows remote attackers to modify the password via a crafted link or IMG tag to vz/cp/pwd. The vulnerability is tied to the web interface’...

CVE-2008-6478

Cross-site request forgery CSRF vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft build 4.0.0-365.6.swsoft and 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag...

CVE-2008-6479

Cross-site request forgery CSRF vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd...

CVE-2008-6478

CVE-2008-6478 describes a CSRF vulnerability in the file manager of the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft). The flaw allows remote attackers to perform administrator-level actions by enticing a user to load ...

CVE-2008-6478: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft build 4.0.0-365.6.swsoft and 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag...

CVE-2008-6479: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft build 3.0.0-25.4.swsoft allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the 1 err, 2 errorcode, and 3 login parameters...

CVE-2008-6465

Multiple cross-site scripting XSS vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the 1 err, 2 errorcode, and 3 login parameters...

CVE-2008-6465

CVE-2008-6465 affects Parallels H-Sphere 3.0.0 P9 and 3.1 P1. The NUCLEI template documents multiple cross-site scripting (XSS) flaws in login.php within webshell4, allowing an attacker to inject arbitrary script/HTML via the parameters (err, errorcode, login). Potential impact includes theft of ...

CVE-2008-6465

Multiple cross-site scripting XSS vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the 1 err, 2 errorcode, and 3 login parameters...

CVE-2008-6465: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in webshell4 in Parallels H-Sphere 3.0.0 P9 and 3.1 P1 allow remote attackers to inject arbitrary web script or HTML via the 1 err, 2 errorcode, and 3 login parameters...

Parallels Plesk Shortnames功能邮件中继漏洞

BUGTRAQ ID: 30956 Plesk是用于管理站点的综合控制面板解决方案。 在Plesk中如果为邮件登录启用了SHORTNAMES=1功能的话，QMAIL就会在AUTH LOGIN认证期间接受任何以有效shortname开始的base64编码用户名。这允许攻击者登录到plesk认证模块所保护的邮件或其他服务，通过获得的smtp认证权限中继垃圾邮件。 必须要从smtpspsa删除SHORTNAMES=1才可以修复这个问题，仅仅将其设置为0无法解决。 Parallels Plesk 8.6 Parallels ---------...

Plesk 8.6.0 authentication flaw allows to gain virtual user priviledges

Hello, the reported vulnerability allows logins to mail and probably other services protected by plesk authentication modules on at least the current Plesk 8.6.0 Unix/Linux and could eg. be used for relaying spam through gained smtp auth priviledges. Only systems which allow short mail login name...

Parallels Virtuozzo Containers 3.0.0-25.4/4.0.0-365.6 VZPP Interface File Manger - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/28589/info Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to use a victim's currently active session to perform certain file-management actions with the privileges o...

Parallels Virtuozzo Containers 3.0.0-25.44.0.0-365.6 VZPP Interface File Manger - Cross-Site Request Forgery

Parallels Virtuozzo Containers 3.0.0-25.44.0.0-365.6 VZPP Interface File Manger - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/28589/info Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacke...

Parallels Virtuozzo Containers 3.0.0-25.4.swsoft VZPP Interface Change Pass - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/28593/info Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will...

Parallels Virtuozzo Containers 3.0.0-25.4.swsoft VZPP Interface Change Pass - Cross-Site Request Forgery

Parallels Virtuozzo Containers 3.0.0-25.4.swsoft VZPP Interface Change Pass - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/28593/info Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability. Exploiting the issue will allow a remote attacker to...