CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4931 – Uncontrolled search path element vulnerability in Plesk
https://notcve.org/view.php?id=CVE-2023-4931
27 Nov 2023 — Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll, samlib.dll, urlmon.dll, sspicli.dll, propsys.dll and profapi.dll files. La vulnerabilidad del elemento de ruta de búsqueda no controlada en Plesk Installer afecta a la versión 3.27.0.0. Un atacante local podría ejecutar código arbitrario inyectando ar... • https://support.plesk.com/hc/en-us/articles/17426121182103 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43784
https://notcve.org/view.php?id=CVE-2023-43784
22 Sep 2023 — Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat. ** DISPUTA ** Plesk Onyx 17.8.11 tiene campos accessKeyId y secretAccessKey que están relacionados con un componente de Amazon AWS Firehose. NOTA: la posición del proveedor es que no existe ninguna amenaza para la seguridad. • https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0829 – Cross-Site Scripting (XSS) vulnerability in Plesk
https://notcve.org/view.php?id=CVE-2023-0829
20 Sep 2023 — Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription. Plesk 17.0 a 18.0.31 es vulnerable a Cross-Site Scripting. El propietario de una suscripción maliciosa (ya sea un cliente o un usuario adicional) puede comprometer completamente el servidor si un administrador visita una determinada página... • https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-plesk • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2023-24044
https://notcve.org/view.php?id=CVE-2023-24044
22 Jan 2023 — A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vendor's position is "the ability to use arbitrary domain names to access the panel is an intended feature." Un problema de inyección de encabezado de host en la página de inicio de sesión de Plesk Obsidian hasta 18.0.49 permite a los atacantes redirigir a los usuarios a sitios web maliciosos a través de un encabezado de solicitud de ... • https://github.com/Cappricio-Securities/CVE-2023-24044 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-45130
https://notcve.org/view.php?id=CVE-2022-45130
10 Nov 2022 — Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version numbers were used through version 12, and then the convention was changed so that versions are identified by names ("Obsidian"), not numbers. Plesk Obsidian permite un ataque CSRF, por ejemplo, a través de la API REST /api/v2/cli/commands para cambiar una contraseña de administrador. NOTA: Obsidian es una versión específica del produ... • https://fortbridge.co.uk/research/compromising-plesk-via-its-rest-api • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2021-45008
https://notcve.org/view.php?id=CVE-2021-45008
21 Feb 2022 — Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users ** EN DISPUTA ** Plesk CMS versión 18.0.37, está afectado por una vulnerabilidad de permisos no seguros que permite una escalada de privilegios de usuario a derechos de administrador. NOTA: el proveedor afirma que esto es sólo un problema específico del sitio web de uno o más ... • https://github.com/AS4mir/CVE-2021-45008 • CWE-281: Improper Preservation of Permissions •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2021-45007
https://notcve.org/view.php?id=CVE-2021-45007
20 Feb 2022 — Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users ** EN DISPUTA ** Plesk versión 18.0.37, está afectado por una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) que permite a un atacante insertar datos en el panel de usuario y de administración. NOTA: el proveedor afirma que esto es sólo un problema e... • https://github.com/AS4mir/CVE-2021-45007 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-35976
https://notcve.org/view.php?id=CVE-2021-35976
10 Sep 2021 — The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability. La funcionalidad para previsualizar un sitio web en Plesk Obsidian 18.0.0 a 18.0.32 en Linux es vulnerable a XSS reflejado a través de /plesk-site-preview/ PATH, ... • https://support.plesk.com/hc/en-us/articles/4402990507026 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-11583
https://notcve.org/view.php?id=CVE-2020-11583
03 Aug 2020 — A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Una vulnerabilidad de tipo XSS reflejada basada en GET en Plesk Obsidian versión 18.0.17, permite a usuarios remotos no autenticados inyectar JavaScript, HTML o CSS arbitrario por medio de un parámetro GET • https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-11584
https://notcve.org/view.php?id=CVE-2020-11584
03 Aug 2020 — A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Una vulnerabilidad de tipo XSS reflejada basada en GET en Plesk Onyx versión 17.8.11, permite a usuarios remotos no autenticados inyectar JavaScript, HTML o CSS arbitrario por medio de un parámetro GET • https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •