CVE-2011-4847

CVE-2011-4847 describes an SQL injection in the Control Panel of Parallels Plesk Panel 10.4.4_build20111103.18. The vulnerability can be exploited remotely by sending a crafted certificateslist cookie to notification@/, potentially allowing arbitrary SQL execution with partial confidentiality/int...

CVE-2011-4725

Technical details (affected versions, root cause, exploit specifics, and fixes) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2011-4760

Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by...

CVE-2011-4766

The CVE-2011-4766 entry concerns Parallels Plesk Small Business Panel 10.2.0, specifically the Site Editor/SiteBuilder and the file wysiwyg/fckconfig.js. The claim is that remote attackers could obtain ASP source code via direct access to that file; however, multiple sources note this is disputed...

CVE-2011-4748

The CVE-2011-4748 entry concerns Parallels Plesk Panel 10.3.1_build1013110726.09, where web pages expose e-mail addresses not meant for deployment correspondence. The issue enables information disclosure by reading the affected pages (e.g., js/ajax/core/ajax.inc.js) and related files. Connected d...

CVE-2011-4744

The CVE-2011-4744 entry concerns Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that the Control Panel sends incorrect Content-Type headers for certain resources, which could allow remote attackers to cause an unspecified impact through an interpretation conflict involving smb/admin...

CVE-2011-4855

The CVE-2011-4855 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel omits the Content-Type header charset parameter for certain resources. This omission could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involvi...

CVE-2011-4763

The CVE-2011-4763 entry describes multiple SQL injection vulnerabilities in the Site Editor (SiteBuilder) feature of Parallels Plesk Small Business Panel 10.2.0. The issue allows remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, demonstrated in Wizard/Edit/Html...

CVE-2011-4753

CVE-2011-4753 corresponds to multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0. The issue affects PHP-based input handling in domains like sitebuilder_edit.php and other files, enabling remote attackers to inject SQL commands through crafted input. The NVD and ...

CVE-2011-4737

The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...

CVE-2011-4733

The CVE-2011-4733 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18 where the Server Administration Panel sends incorrect Content-Type headers for certain resources. The description indicates an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and ...

CVE-2011-4732

The CVE-2011-4732 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18. The issue is that the Server Administration Panel omits the Content-Type header's charset parameter for certain resources, which may enable remote attackers to cause an unspecified impact via an interpretation confl...

CVE-2011-4852

The CVE-2011-4852 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and related files, enabling cross-domain referer leakage. This can allow rem...

CVE-2011-4767

The CVE-2011-4767 issue affects Parallels Plesk Small Business Panel 10.2.0, specifically the Site Editor (SiteBuilder) feature. It describes web pages containing e-mail addresses not intended for deployment-related correspondence, enabling remote attackers to obtain potentially sensitive informa...

CVE-2011-4764

CVE-2011-4764 describes multiple XSS vulnerabilities in the Site Editor (SiteBuilder) feature of Parallels Plesk Small Business Panel 10.2.0 . The issues allow remote attackers to inject arbitrary web script or HTML via crafted input in a PHP script, demonstrated through Wizard/Edit/Modules/Image...

CVE-2011-4727

The CVE-2011-4727 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18: the Server Administration Panel mishandles string data intended for XML storage, enabling a remote attacker to trigger a parsing error via crafted REST URL parameters (e.g., to admin/ and related files), resulting in...

CVE-2011-4852

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by...

CVE-2011-4738

The CVE-2011-4738 entry describes a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20 where the HTTPOnly flag is missing on a Set-Cookie header. This absence allows remote attackers to access cookie values via script, potentially exposing sensitive information such as data used by g...

CVE-2011-4856

The Control Panel in Parallels Plesk Panel 10.4.4build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain other files. NOTE: ...

CVE-2011-4740

The CVE-2011-4740 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is described as a cross-domain Referer leakage: the Control Panel generates web pages containing external links in response to GET requests with specific query strings (e.g., smb/app/search-data/catalogId/ma...