CVE-2011-4734

Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files...

CVE-2011-4736

The CVE-2011-4736 issue affects Parallels Plesk Panel (Control Panel) version 10.2.0 build 20110407.20, where cleartext passwords are transmitted over HTTP in login_up.php3 and related files. Root cause: credentials sent unencrypted, enabling network sniffing. Impact is limited to exposed authent...

CVE-2011-4854

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the...

CVE-2011-4744

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/featured-applications/ and certain oth...

CVE-2011-4746

Parallels Plesk Panel 10.3.1_build1013110726.09’s billing system does not disable SSL 2.0, enabling remote spoofing by exploiting SSL 2.0 weaknesses. Root cause: SSL 2.0 support remains active in the affected component. The documents do not specify exploit availability or in-the-wild use, and no ...

CVE-2011-4849

The CVE-2011-4849 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel does not set the Secure flag on cookies during HTTPS sessions. This can allow an attacker to capture the cookies by intercepting HTTP traffic, as demonstrated by cookies used by help.php and oth...

CVE-2011-4777

CVE-2011-4777 affects Parallels Plesk Panel (Site Editor/SiteBuilder) 10.4.4_build20111103.18. The vulnerability is a Cross-site Scripting (XSS) flaw in the Site Editor that allows injection of arbitrary script/HTML via the login parameter to preferences.html. Affected component: Site Editor in P...

CVE-2011-4729

CVE-2011-4729 : The Parallels Plesk Panel 10.2.0_build1011110331.18 Server Administration Panel fails to set the HTTPOnly flag on cookies (notably those used by login_up.php3 and other files). This exposes cookies to access via client-side scripts, leading to potential disclosure of sensitive inf...

CVE-2011-4737

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/...

CVE-2011-4856

The CVE concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel sends incorrect Content-Type headers for certain resources. This creates an interpretation conflict involving admin/health/parameters and other files, which could allow remote attackers to achieve an unspecifi...

CVE-2011-4742

The CVE-2011-4742 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20: the Control Panel exposes web pages containing e-mail addresses not intended for that deployment, enabling remote attackers to obtain potentially sensitive information by reading pages such as smb/user/list. Documents...

CVE-2011-4730

The vulnerability CVE-2011-4730 affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically its Server Administration Panel. The underlying issue is that the password form field is generated without disabling the browser autocomplete feature, which can allow an attacker to bypass authen...

CVE-2011-4756

CVE-2011-4756 affects Parallels Plesk Small Business Panel 10.2.0. The cookie Set-Cookie header does not include the HttpOnly flag, enabling potential script access to cookies used by domains/sitebuilder_edit.php and related files, which could expose sensitive information. The connected documents...

CVE-2011-4743

The CVE-2011-4743 entry concerns Parallels Plesk Panel 10.2.0, build 20110407.20, where the Control Panel omits the Content-Type header’s charset parameter for certain resources. This could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involving sm...

CVE-2011-4851

The CVE-2011-4851 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel generates a password form field without disabling autocomplete, enabling attackers to bypass authentication on unattended workstations, as demonstrated by forms in server/google-tools/ and other file...

CVE-2011-4848

The CVE-2011-4848 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel erroneously places a submitted password inside an HTTP response body, enabling remote attackers to obtain sensitive information by sniffing the network. Documented in NVD, the impact is information d...

CVE-2011-4739

CVE-2011-4739 affects Parallels Plesk Panel Control Panel version 10.2.0 build 20110407.20. The underlying issue is that the password form field is generated without disabling autocomplete, which can allow remote attackers to bypass authentication by exploiting an unattended workstation. Demonstr...

CVE-2011-4734

CVE-2011-4734 describes multiple SQL injection vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The underlying vulnerability is in input handling for PHP scripts, with inputs such as those in file-manager/ and related components allowing a remote attacker to...

CVE-2011-4761

Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilderedit.php and certain other files. NOTE: it is...

CVE-2011-4760

The CVE-2011-4760 entry concerns Parallels Plesk Small Business Panel version 10.2.0, where web pages expose e-mail addresses not intended for public correspondence about the local deployment. The vulnerability arises from information disclosure via pages such as smb/email-address/list, enabling ...