CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4763
https://notcve.org/view.php?id=CVE-2011-4763
Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files. Multiples vulnerabilidades de inyección SQL en la funcinalidad "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0 permiten a usuarios remotos ejecutar comandos SQL de su elección a través de una entrada modificada a un script PHP, tal como se ha demostrado en "Wizard/Edit/Html" y otros archivos concretos. • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72215 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4755
https://notcve.org/view.php?id=CVE-2011-4755
Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as demonstrated by cookies to client@1/domain@1/hosting/file-manager/ and certain other files. Parallels Plesk Small Business Panel 10.2.0 no valida apropiadamente datos de cadena de texto que son utilizados para almacenamiento en un documento XML, lo que facilita a atacantes remotos provocar una denegación de servicio (error de "parseo") o posiblemente tener otros impactos sin especificar a través de una cookie modificada, como se ha demostrado con cookies de "client@1/domain@1/hosting/file-manager/" y otros archivos determinados. • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72207 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4758
https://notcve.org/view.php?id=CVE-2011-4758
Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files. Parallels Plesk Small Business Panel 10.2.0 recibe entradas con contraseñas en texto claro sobre HTTP, lo que permite a atacantes remotos obtener información confidencial leyendo el tráfico de red, como se ha demostrado con formularios en "smb/auth" y otros archivos determinados. • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72210 • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4762
https://notcve.org/view.php?id=CVE-2011-4762
Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue. Parallels Plesk Small Business Panel 10.2.0 envía cabeceras Content-Type incorrectas a determinados recursos, lo que permite a atacantes remotos tener un impacto sin especificar utilizando un conflicto de interpretación que involucre "smb/app/top-categories-data/" y otros archivos concretos. NOTA: es posible que sólo clientes, y no el producto SmarterStats, pueden estar afectados. • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72214 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4765
https://notcve.org/view.php?id=CVE-2011-4765
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files. La característica "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0 no incluye la etiqueta HTTPOnly en una cabecera Set-Cookie para una cookie, lo que facilita a atacantes remotos obtener información confidencial a través de un acceso mediante script a esta cookie. Tal como se ha demostrado por cookies utilizadas Wizard/Edit/Modules/ImageGallery/MultiImagesUpload y otros archivos determinados. • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72217 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •