CVE-2011-4848

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under...

CVE-2011-4726

Multiple cross-site scripting XSS vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files...

CVE-2011-4745

CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...

CVE-2011-4853

CVE-2011-4853 affects Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel exposes an RFC 1918 (private) IP address within a web page, which allows remote attackers to read the page and potentially access sensitive information. Demonstrated by access to smb/user/list-data/items-per-pa...

CVE-2011-4850

The CVE-2011-4850 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the HTTPOnly flag is absent in a Set-Cookie header used by cookies (e.g., in help.php), allowing remote attackers to access cookie data via script. This could partially expose sensitive information as described. ...

CVE-2011-4755

Parallels Plesk Small Business Panel 10.2.0 is affected by CVE-2011-4755 due to improper validation of string data intended for XML storage. The root cause is parsing of crafted cookies, which can trigger a denial of service (parsing error) and potentially other unspecified impact. The vulnerabil...

CVE-2011-4745

Multiple cross-site scripting XSS vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files...

CVE-2011-4748

The billing system for Parallels Plesk Panel 10.3.1build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as...

PT-2011-5096 · Parallels · Parallels Plesk Small Business Panel

Name of the Vulnerable Software and Affected Versions: Parallels Plesk Small Business Panel version 10.2.0 Description: The Site Editor feature in Parallels Plesk Small Business Panel allows remote attackers to obtain ASP source code via a direct request to "wysiwyg/fckconfig.js". Note that the...

Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability Release Date: ============= 2011-07-12 Vulnerability Laboratory ID VL-ID: ==================================== 152 Product & Service Introduction: =============================== Parallels Plesk Panel...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk 8.2 URL Redirection

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability 1. OVERVIEW The Plesk versions from 7.0 to 8.2 are vulnerable to Open URL Redirection when "Enable [email protected]" access format, a new feature introduced in Plesk 7.0, is enabled in user preferences. 2. BACKGROUND Parallels Plesk...

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability 1. OVERVIEW The Plesk versions from 7.0 to 8.2 are vulnerable to Open URL Redirection when "Enable [email protected]" access format, a new feature introduced in Plesk 7.0, is enabled in user preferences. 2. BACKGROUND Parallels Plesk...

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities

XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date: 2010-09-17 Author : David Hoyt – http://cloudscan.me Contact : [email protected] Home...

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities

Plesk Small Business Manager 10.2.0 and Site Editor - Multiple Vulnerabilities XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date:...

Plesk Small Business Manager 10.2 Cross Site Scripting / SQL Injection

XSS + SQL Injection in Plesk Small Business Manager 10.2 + Site Editor Vendor: Plesk Small Business Manager 10.2 + Site Editor Product Description URL http://www.parallels.com/products/small-business-panel/ Date: 2010-09-17 Author : David Hoyt – http://cloudscan.me Contact : [email protected] Home...

Parallels Plesk Sitebuilder Persistent Xss Vulnerability

Exploit for php platform in category web applications ======================================================== Parallels Plesk Sitebuilder Persistent Xss Vulnerability ======================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0...

Plesk Server Administrator (PSA) LFI Vulnerability - Active Check

Plesk Server Administrator PSA is prone to a local file include LFI vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Parallels System Automation (PSA) Local File Inclusion

No description provided by source. Application Info: Name: Parallels System Automation PSA Vendor: http://Parallels.com Vulnerability Info: Type: Local File Inclusion Risk: Medium Vulnerability:...