CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4766
https://notcve.org/view.php?id=CVE-2011-4766
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allows remote attackers to obtain ASP source code via a direct request to wysiwyg/fckconfig.js. NOTE: CVE disputes this issue because ASP is only used in a JavaScript comment ** CONTROVERTIDA ** La característica "Site Editor" (SiteBuilder) de Parallels Plesk Small Business Panel 10.2.0 permite a atacantes remotos obtener el código fuente ASP a través de peticiones directas a wysiwyg/fckconfig.js. NOTA: CVE discute este asunto debido a que ASP es utilizado sólo en un comentario JavaScript. • http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4777
https://notcve.org/view.php?id=CVE-2011-4777
Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad "Site Editor" (SiteBuilder) de Parallels Plesk Panel 10.4.4_build20111103.18. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través del parámetro login de preferences.html. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4850
https://notcve.org/view.php?id=CVE-2011-4850
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by help.php and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 no incluye la etiqueta HTTPOnly en la cabecera Set-Cookie para una cookie, lo que facilita a atacantes remotos obtener información confidencial a través del acceso mediante scripts a esta cookie, tal como se ha demostrado por cookies en help.php y otros archivos determinados. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4849
https://notcve.org/view.php?id=CVE-2011-4849
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 no habilita la opción "secure flag" para cookies de una sesión https, lo que facilita a atacantes remotos capturar esta cookie interceptándola en una sesión http. Tal como se ha demostrado por cookies utilizadas en help.php y otros determinados archivos. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72224 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4735
https://notcve.org/view.php?id=CVE-2011-4735
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el panel del control de Parallels Plesk Panel 10.2.0 build 20110407.20. Permiten a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de datos de entrada modificados de scripts PHP, tal como se ha demostrado en smb/user/create y otros archivos concretos. • http://www.kb.cert.org/vuls/id/541814 http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72324 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •