42 matches found
CVE-2013-4878
CVE-2013-4878 affects Parallels Plesk Panel 9.0.x–9.2.x on UNIX and Small Business Panel 10.x on UNIX, due to an improper ScriptAlias directive for phppath that enables remote code execution via crafted requests. Affected versions expose code execution under the web server user; exploitation reli...
CVE-2012-1557
Parallels Plesk Panel contains an SQL injection in admin/plib/api-rpc/Agent.php affecting multiple lines: 7.x/8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5. The vulnerability allows remote attackers to execute arbi...
CVE-2013-0133
CVE-2013-0133 affects Parallels Plesk Panel 11.0.9 (and related versions referenced in the linked sources) where the program /usr/local/psa/admin/sbin/wrapper is vulnerable to an untrusted search path attack. An attacker with local access and PSA administrator rights can cause privilege escalatio...
CVE-2013-0132
The CVE-2013-0132 entry documents a vulnerability in Parallels Plesk Panel 11.0.9 where the suexec implementation uses a cgi-wrapper whitelist entry that, because suexec does not sanitize environment variables, allows a user-assisted remote attacker to execute arbitrary PHP code via a crafted req...
CVE-2011-4855
The CVE-2011-4855 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel omits the Content-Type header charset parameter for certain resources. This omission could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involvi...
CVE-2019-18793
CVE-2019-18793 affects Parallels Plesk Panel 9.5 with a stored/reflected XSS in target/locales/tr-TR/help/index.htm? via the fileName parameter. The issue is a cross-site scripting flaw in that specific page, allowing injected script to be treated as part of the web page. Several connected source...
CVE-2011-4741
The CVE-2011-4741 entry pertains to Parallels Plesk Panel 10.2.0 build 20110407.20. The Control Panel includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading the page at client@2/domain@1/hosting/aspdotnet/. The...
CVE-2011-4745
CVE-2011-4745: Multiple XSS vulnerabilities in the Parallels Plesk Panel billing system (10.3.1_build1013110726.09). The issue stems from inadequate input sanitization in a PHP script (e.g., admin/index.php/default), enabling remote attackers to inject arbitrary JavaScript/HTML. Exploitation stat...
CVE-2011-4726
Parallels Plesk Panel 10.2.0_build1011110331.18 contains multiple XSS vulnerabilities in the Server Administration Panel. The issue allows remote attackers to inject arbitrary web script or HTML via crafted input to PHP scripts, demonstrated by inputs to files such as admin/health/ . Root cause c...
CVE-2011-4851
The CVE-2011-4851 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel generates a password form field without disabling autocomplete, enabling attackers to bypass authentication on unattended workstations, as demonstrated by forms in server/google-tools/ and other file...
CVE-2011-4852
The CVE-2011-4852 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and related files, enabling cross-domain referer leakage. This can allow rem...
CVE-2011-4727
The CVE-2011-4727 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18: the Server Administration Panel mishandles string data intended for XML storage, enabling a remote attacker to trigger a parsing error via crafted REST URL parameters (e.g., to admin/ and related files), resulting in...
CVE-2011-4739
CVE-2011-4739 affects Parallels Plesk Panel Control Panel version 10.2.0 build 20110407.20. The underlying issue is that the password form field is generated without disabling autocomplete, which can allow remote attackers to bypass authentication by exploiting an unattended workstation. Demonstr...
CVE-2011-4743
The CVE-2011-4743 entry concerns Parallels Plesk Panel 10.2.0, build 20110407.20, where the Control Panel omits the Content-Type header’s charset parameter for certain resources. This could allow remote attackers to cause an unspecified impact by exploiting an interpretation conflict involving sm...
CVE-2011-4777
CVE-2011-4777 affects Parallels Plesk Panel (Site Editor/SiteBuilder) 10.4.4_build20111103.18. The vulnerability is a Cross-site Scripting (XSS) flaw in the Site Editor that allows injection of arbitrary script/HTML via the login parameter to preferences.html. Affected component: Site Editor in P...
CVE-2011-4856
The CVE concerns Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel sends incorrect Content-Type headers for certain resources. This creates an interpretation conflict involving admin/health/parameters and other files, which could allow remote attackers to achieve an unspecifi...
CVE-2011-4730
The vulnerability CVE-2011-4730 affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically its Server Administration Panel. The underlying issue is that the password form field is generated without disabling the browser autocomplete feature, which can allow an attacker to bypass authen...
CVE-2011-4847
CVE-2011-4847 describes an SQL injection in the Control Panel of Parallels Plesk Panel 10.4.4_build20111103.18. The vulnerability can be exploited remotely by sending a crafted certificateslist cookie to notification@/, potentially allowing arbitrary SQL execution with partial confidentiality/int...
CVE-2011-4853
CVE-2011-4853 affects Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel exposes an RFC 1918 (private) IP address within a web page, which allows remote attackers to read the page and potentially access sensitive information. Demonstrated by access to smb/user/list-data/items-per-pa...
CVE-2011-4731
The CVE-2011-4731 issue affects Parallels Plesk Panel 10.2.0_build1011110331.18, specifically the Server Administration Panel. A web page inadvertently includes an RFC 1918 internal IP address, enabling remote attackers to read the page and potentially obtain sensitive information (e.g., via admi...
CVE-2011-4733
The CVE-2011-4733 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18 where the Server Administration Panel sends incorrect Content-Type headers for certain resources. The description indicates an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and ...
CVE-2011-4749
Affected software: Parallels Plesk Panel 10.3.1_build1013110726.09. The vulnerability is that the billing system’s password field is generated with autocomplete enabled, enabling bypass of authentication by a user with an unattended workstation, as demonstrated on forms under admin/index.php/defa...
CVE-2011-4776
CVE-2011-4776 describes multiple XSS vulnerabilities in Parallels Plesk Panel 10.4.4_build20111103.18. The issue allows remote attackers to inject arbitrary JavaScript/HTML via crafted input to PHP scripts, demonstrated via admin/update/settings/ and other files in the Control Panel. The provided...
CVE-2011-4732
The CVE-2011-4732 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18. The issue is that the Server Administration Panel omits the Content-Type header's charset parameter for certain resources, which may enable remote attackers to cause an unspecified impact via an interpretation confl...
CVE-2011-4737
The CVE-2011-4737 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that a submitted password is included in an HTTP response body (in a path involving client@2/domain@1/odbc/dsn@1/properties/), enabling remote attackers to obtain sensitive information by sniffing network...
CVE-2011-4747
Parallels Plesk Panel 10.3.1_build1013110726.09 is affected by CVE-2011-4747 due to a flaw in SSL configuration that allows use of weak ciphers through a crafted CipherSuite list, enabling remote attackers to defeat cryptographic protections. The vulnerability targets the billing system component...
CVE-2011-4735
CVE-2011-4735 involves multiple XSS vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The flaws allow remote attackers to inject arbitrary web scripts or HTML via crafted input to a PHP script, with examples including smb/user/create. The affected product is ...
CVE-2011-4738
The CVE-2011-4738 entry describes a vulnerability in Parallels Plesk Panel 10.2.0 build 20110407.20 where the HTTPOnly flag is missing on a Set-Cookie header. This absence allows remote attackers to access cookie values via script, potentially exposing sensitive information such as data used by g...
CVE-2011-4740
The CVE-2011-4740 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is described as a cross-domain Referer leakage: the Control Panel generates web pages containing external links in response to GET requests with specific query strings (e.g., smb/app/search-data/catalogId/ma...
CVE-2011-4744
The CVE-2011-4744 entry concerns Parallels Plesk Panel 10.2.0 build 20110407.20. The issue is that the Control Panel sends incorrect Content-Type headers for certain resources, which could allow remote attackers to cause an unspecified impact through an interpretation conflict involving smb/admin...
CVE-2011-4728
The CVE-2011-4728 entry concerns Parallels Plesk Panel 10.2.0_build1011110331.18, where the Server Administration Panel does not set the secure flag on a cookie during HTTPS sessions. This allows an attacker to capture the cookie by probing or intercepting traffic in an HTTP context, as demonstra...
CVE-2011-4729
CVE-2011-4729 : The Parallels Plesk Panel 10.2.0_build1011110331.18 Server Administration Panel fails to set the HTTPOnly flag on cookies (notably those used by login_up.php3 and other files). This exposes cookies to access via client-side scripts, leading to potential disclosure of sensitive inf...
CVE-2011-4848
The CVE-2011-4848 entry concerns Parallels Plesk Panel 10.4.4_build20111103.18. The Control Panel erroneously places a submitted password inside an HTTP response body, enabling remote attackers to obtain sensitive information by sniffing the network. Documented in NVD, the impact is information d...
CVE-2011-4849
The CVE-2011-4849 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the Control Panel does not set the Secure flag on cookies during HTTPS sessions. This can allow an attacker to capture the cookies by intercepting HTTP traffic, as demonstrated by cookies used by help.php and oth...
CVE-2011-4850
The CVE-2011-4850 entry affects Parallels Plesk Panel 10.4.4_build20111103.18, where the HTTPOnly flag is absent in a Set-Cookie header used by cookies (e.g., in help.php), allowing remote attackers to access cookie data via script. This could partially expose sensitive information as described. ...
CVE-2011-4854
The CVE-2011-4854 issue affects Parallels Plesk Panel 10.4.4_build20111103.18: the Control Panel does not ensure that Content-Type HTTP headers match the Content-Type data in HTML META elements, potentially allowing remote attackers to trigger an interpretation conflict involving get_enabled_prod...
CVE-2011-4742
The CVE-2011-4742 entry affects Parallels Plesk Panel 10.2.0 build 20110407.20: the Control Panel exposes web pages containing e-mail addresses not intended for that deployment, enabling remote attackers to obtain potentially sensitive information by reading pages such as smb/user/list. Documents...
CVE-2011-4746
Parallels Plesk Panel 10.3.1_build1013110726.09’s billing system does not disable SSL 2.0, enabling remote spoofing by exploiting SSL 2.0 weaknesses. Root cause: SSL 2.0 support remains active in the affected component. The documents do not specify exploit availability or in-the-wild use, and no ...
CVE-2011-4725
Technical details (affected versions, root cause, exploit specifics, and fixes) are not provided in the supplied documents. Monitor for updates from official advisories.
CVE-2011-4736
The CVE-2011-4736 issue affects Parallels Plesk Panel (Control Panel) version 10.2.0 build 20110407.20, where cleartext passwords are transmitted over HTTP in login_up.php3 and related files. Root cause: credentials sent unencrypted, enabling network sniffing. Impact is limited to exposed authent...
CVE-2011-4734
CVE-2011-4734 describes multiple SQL injection vulnerabilities in the Control Panel of Parallels Plesk Panel 10.2.0 build 20110407.20. The underlying vulnerability is in input handling for PHP scripts, with inputs such as those in file-manager/ and related components allowing a remote attacker to...
CVE-2011-4748
The CVE-2011-4748 entry concerns Parallels Plesk Panel 10.3.1_build1013110726.09, where web pages expose e-mail addresses not meant for deployment correspondence. The issue enables information disclosure by reading the affected pages (e.g., js/ajax/core/ajax.inc.js) and related files. Connected d...