CVE-2011-4765

The CVE concerns Parallels Plesk Small Business Panel 10.2.0, where the Site Editor (SiteBuilder) feature fails to set the HTTPOnly flag on a Set-Cookie header. This omission allows scripts to access the cookie, potentially leaking sensitive information via cookies used by Wizard/Edit/Modules/Ima...

CVE-2011-4762

CVE-2011-4762 affects Parallels Plesk Small Business Panel 10.2.0. The issue is that it sends incorrect Content-Type headers for certain resources, potentially enabling a remote attacker to exploit an interpretation conflict involving smb/app/top-categories-data/ and other files, with unspecified...

CVE-2011-4754

CVE-2011-4754 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0. The issue allows remote attackers to inject arbitrary web script or HTML through crafted input to a PHP script, with examples including smb/app/available/id/apscatalog/...

CVE-2011-4749

Affected software: Parallels Plesk Panel 10.3.1_build1013110726.09. The vulnerability is that the billing system’s password field is generated with autocomplete enabled, enabling bypass of authentication by a user with an unattended workstation, as demonstrated on forms under admin/index.php/defa...

CVE-2011-4731

The CVE-2011-4731 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically the Server Administration Panel. A web page inadvertently includes an RFC 1918 internal IP address, enabling remote attackers to read the page and potentially obtain sensitive information (e.g., via admi...

CVE-2011-4768

Parallels Plesk Small Business Panel 10.2.0 Site Editor (SiteBuilder) omits the Content-Type header charset parameter for certain resources, which might allow remote attackers to cause an unspecified impact via a interpretation conflict involving Wizard/Edit/Modules/Image and related files. The a...

CVE-2011-4761

The CVE-2011-4761 entry concerns Parallels Plesk Small Business Panel 10.2.0, where the Content-Type header omits the charset parameter for certain resources (notably involving domains/sitebuilder_edit.php). This omission could allow remote attackers to achieve an unspecified impact via an interp...

CVE-2011-4759

Parallels Plesk Small Business Panel 10.2.0 is affected by a cross-domain Referer leakage issue. When handling GET requests with specific query strings (e.g., client@1/domain@1/hosting/file-manager/ and related paths), the application generates web pages containing external links, which can allow...

CVE-2011-4757

Parallels Plesk Small Business Panel 10.2.0 is affected: a password form field is generated without disabling autocomplete, enabling possible authentication bypass on unattended workstations through forms such as smb/auth. Root cause is autocomplete not being disabled on the password field. The c...

CVE-2011-4745

CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...

CVE-2011-4741

The CVE-2011-4741 entry pertains to Parallels Plesk Panel 10.2.0 build 20110407.20. The Control Panel includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading the page at client@2/domain@1/hosting/aspdotnet/. The...

CVE-2011-4735

CVE-2011-4735 involves multiple XSS vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The flaws allow remote attackers to inject arbitrary web scripts or HTML via crafted input to a PHP script, with examples including smb/user/create. The affected product is ...

CVE-2011-4853

CVE-2011-4853 affects Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel exposes an RFC 1918 (private) IP address within a web page, which allows remote attackers to read the page and potentially access sensitive information. Demonstrated by access to smb/user/list-data/items-per-pa...

CVE-2011-4755

Parallels Plesk Small Business Panel 10.2.0 is affected by CVE-2011-4755 due to improper validation of string data intended for XML storage. The root cause is parsing of crafted cookies, which can trigger a denial of service (parsing error) and potentially other unspecified impact. The vulnerabil...

CVE-2011-4726

Parallels Plesk Panel 10.2.0_build1011110331.18 contains multiple XSS vulnerabilities in the Server Administration Panel. The issue allows remote attackers to inject arbitrary web script or HTML via crafted input to PHP scripts, demonstrated by inputs to files such as admin/health/ . Root cause c...

PT-2011-5096 · Parallels · Parallels Plesk Small Business Panel

Name of the Vulnerable Software and Affected Versions: Parallels Plesk Small Business Panel version 10.2.0 Description: The Site Editor feature in Parallels Plesk Small Business Panel allows remote attackers to obtain ASP source code via a direct request to "wysiwyg/fckconfig.js". Note that the...

Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability

Document Title: =============== Micro CMS v1.0.1 - Persistent Cross Site Scripting Vulnerability Release Date: ============= 2011-07-12 Vulnerability Laboratory ID VL-ID: ==================================== 152 Product & Service Introduction: =============================== Parallels Plesk Panel...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability

Document Title: =============== Parallels Plesk v9.0.2b - Cross Site Scripting Vulnerability Release Date: ============= 2011-06-12 Vulnerability Laboratory ID VL-ID: ==================================== 153 Product & Service Introduction: =============================== Parallels Plesk Panel ist...

Parallels Plesk 8.2 URL Redirection

Parallels Plesk 7.0 - 8.2 | Open URL Redirection Vulnerability 1. OVERVIEW The Plesk versions from 7.0 to 8.2 are vulnerable to Open URL Redirection when "Enable [email protected]" access format, a new feature introduced in Plesk 7.0, is enabled in user preferences. 2. BACKGROUND Parallels Plesk...