VulnCheck KEV: CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

Plesk 9.5.4 - Remote Command Execution

Plesk 9.5.4 - Remote Command Execution Plesk Apache zeroday / June 2013 discovered & exploited by kingcope this Plesk configuration setting makes it possible: scriptAlias /phppath/ "/usr/bin/" Furthermore this is not cve-2012-1823 because the php interpreter is called directly. no php file is...

Plesk < 9.5.4 - Remote Command Execution

Plesk Apache zeroday / June 2013 discovered & exploited by kingcope this Plesk configuration setting makes it possible: scriptAlias /phppath/ "/usr/bin/" Furthermore this is not cve-2012-1823 because the php interpreter is called directly. no php file is called Parallels Plesk Remote Exploit -- P...

Plesk Horde Detection

The remote web server is running Horde, an open source, PHP-based application framework from The Horde Project. This installation was detected on a web server configured with Parallels Plesk Panel, a web hosting control panel. Plesk pre-configures the Horde install with a virtual host such as...

CVE-2013-0133

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

CVE-2013-0132

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

Code injection

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

CVE-2013-0132

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

CVE-2013-0133

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

Design/Logic Flaw

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

CVE-2013-0133

Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable...

CVE-2013-0132

The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables...

CVE-2013-0132

The CVE-2013-0132 entry documents a vulnerability in Parallels Plesk Panel 11.0.9 where the suexec implementation uses a cgi-wrapper whitelist entry that, because suexec does not sanitize environment variables, allows a user-assisted remote attacker to execute arbitrary PHP code via a crafted req...

CVE-2013-0133

CVE-2013-0133 affects Parallels Plesk Panel 11.0.9 (and related versions referenced in the linked sources) where the program /usr/local/psa/admin/sbin/wrapper is vulnerable to an untrusted search path attack. An attacker with local access and PSA administrator rights can cause privilege escalatio...

Plesk Panel 11.0.9 privilege escalation vulnerabilities

Overview Plesk Panel 11.0.9 and possibly earlier versions contains multiple privilege escalation vulnerabilities. Description Plesk Panel contains multiple privilege escalation vulnerabilities which may allow an attacker to run arbitrary code as the root user. Special-case rules in Plesk's custom...

Plesk Backdoor RCE

Plesk Backdoor Arbitrary Command Execution Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=714 Reward: 3000$ Release Date: ============= 2012-11-01 Vulnerability Laboratory ID VL-ID:...

Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9b - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=714 Reward: 3000$ Release Date: ============= 2012-11-01 Vulnerability Laboratory ID VL-ID:...

Parallels Plesk v11.0.9 - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=699 Release Date: ============= 2012-08-31 Vulnerability Laboratory ID VL-ID: ==================================== 699...

Parallels Plesk v11.0.9 - Multiple Web Vulnerabilities

Document Title: =============== Parallels Plesk v11.0.9 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=699 Release Date: ============= 2012-08-31 Vulnerability Laboratory ID VL-ID: ==================================== 699...