CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4753
https://notcve.org/view.php?id=CVE-2011-4753
16 Dec 2011 — Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files. Multiples vulnerabilidades de inyección SQL en Parallels Plesk Small Business Panel 10.2.0 permiten a usuarios remotos ejecutar comandos SQL de su elección a través de entradas modificadas a un script PHP, tal como se ha demostrado por domains/sitebuilder_edit.... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2011-4745
https://notcve.org/view.php?id=CVE-2011-4745
16 Dec 2011 — Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en en el sistema de tarificación de Parallels Plesk Panel 10.3.1_build1013110726.09. Permiten a atacantes remotos inyectar codigo de script web... • http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4729
https://notcve.org/view.php?id=CVE-2011-4729
16 Dec 2011 — The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files. El panel de administración del servidor de Parallels Plesk Panel 10.2.0_build1011110331.18 no incluye la etiqueta HTTPOnly en una cabecera Set-Cookie para una coo... • http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4758
https://notcve.org/view.php?id=CVE-2011-4758
16 Dec 2011 — Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files. Parallels Plesk Small Business Panel 10.2.0 recibe entradas con contraseñas en texto claro sobre HTTP, lo que permite a atacantes remotos obtener información confidencial leyendo el tráfico de red, como se ha demostrado con formularios en "smb/auth" y otros archivos determi... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2011-4727
https://notcve.org/view.php?id=CVE-2011-4727
16 Dec 2011 — The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files. El panel de administración del servidor de Parallels Plesk Panel 10.2.0_build1011110331.18 no valida apropiadamente datos de ... • http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4848
https://notcve.org/view.php?id=CVE-2011-4848
16 Dec 2011 — The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 incluye una contraseña suministrada ("submitted") dentro del cuerpo de la respuesta HTTP, lo que facilita a atacantes remotos... • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4765
https://notcve.org/view.php?id=CVE-2011-4765
16 Dec 2011 — The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files. La característica "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0 no incluye la etiqueta HTT... • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4736
https://notcve.org/view.php?id=CVE-2011-4736
16 Dec 2011 — The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in login_up.php3 and certain other files. El panel de control de Parallels Plesk Panel 10.2.0 build 20110407.20 recibe contraseñas en texto claro en peticiones HTTP, lo que permite a atacantes remotos obtener información confidencial interceptando el tráfico de red, tal como se ha demos... • http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2011-4762
https://notcve.org/view.php?id=CVE-2011-4762
16 Dec 2011 — Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue. Parallels Plesk Small Business Panel 10.2.0 envía cabeceras Content-Type incorrectas a determinados recursos, lo que permite a atacante... • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4847
https://notcve.org/view.php?id=CVE-2011-4847
16 Dec 2011 — SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/. Vulnerabilidad de inyección SQL en el panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una cookie certificateslist s notification@/. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •