CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4739
https://notcve.org/view.php?id=CVE-2011-4739
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/my-profile and certain other files. El panel de control de Parallels Plesk Panel 10.2.0 build 20110407.20 genera un campo de formulario de contraseña sin deshabilitar la opción de autocompletado, lo que facilita a atacantes remotos evitar la autenticación accediendo a un ordenador desatendido, tal como se ha demostrado en formularios bajo smb/my-profile y otros archivos determinados. • http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72320 • CWE-255: Credentials Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4767
https://notcve.org/view.php?id=CVE-2011-4767
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/Wizard/Status.js and certain other files. La característica "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0 tiene páginas web que contienen direcciones de e-mail no previstas utilizadas para el desarrollo de la aplicación, lo que permite a atacantes remotos obtener información confidencial leyendo una página. Tal como se ha demostrado por js/Wizard/Status.js y otros archivos determinados. • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72218 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2011-4852
https://notcve.org/view.php?id=CVE-2011-4852
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 genera páginas web que contienen enlaces externos en respuesta a peticiones GET con cadenas de búsqueda "enterprise/mobile-monitor/" y otros archivos determinados, lo que facilita a atacantes remotos obtener información confidencial leyendo (1) logs de acceso al servidor web o (2) logs Referer. Relacionado con un problema de pérdida de Referer entre dominios. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72095 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4855
https://notcve.org/view.php?id=CVE-2011-4855
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 omite el parámetro charset de la cabecera Content-Type para determinados recursos, lo que permite a atacantes remotos tener un impacto sin especificar utilizando un conflicto de interpretación que involucre "admin/customer-service-plan/list/reset-search/true/" y otros archivos determinados. NOTE: es posible que sólo clientes, no el producto Plesk, puedan estar afectado. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72092 •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2011-4748
https://notcve.org/view.php?id=CVE-2011-4748
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/ajax/core/ajax.inc.js and certain other files. El sistema de tarificación de Parallels Plesk Panel 10.3.1_build1013110726.09 contiene páginas web que incluyen direcciones de email imprevistas para su uso en el desarrollo local de la aplicación, lo que permite a atacantes remotos obtener información confidencial leyendo una página, tal como se ha demostrado con js/ajax/core/ajax.inc.js y otros archivos determinados. • http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72261 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •