CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4731
https://notcve.org/view.php?id=CVE-2011-4731
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files. El panel de administración del servidor de Parallels Plesk Panel 10.2.0_build1011110331.18 incluye una dirección IP RFC 1918 dentro de una página web, lo que permite a atacantes remotos obtener información confidencial leyendo esta página, como se ha demostrado con admin/home/admin y otros archivos concretos. • http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build-1011110331.18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4743
https://notcve.org/view.php?id=CVE-2011-4743
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. El panel de control de Parallels Plesk Panel 10.2.0 build 20110407.20 omite el parámetro charset de la cabecera para determinados recursos, lo que permite a atacantes remotos tener un impacto sin especificar utilizando un conflicto de interpretación que involucre smb/user/create y otros archivos concretos. NOTA: es posible que sólo clientes, no el producto Plesk, estén afectados. • http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72316 •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4742
https://notcve.org/view.php?id=CVE-2011-4742
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/user/list and certain other files. El panel de control de Parallels Plesk Panel 10.2.0 build 20110407.20 contiene páginas web que incluyen direcciones de e-mail sobre el desarrollo local no previstas para su publicación, lo que permite a atacantes remotos obtener información confidencial leyendo una página, como se ha demostrado con smb/user/list y otros archivos concretos. • http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72317 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4759
https://notcve.org/view.php?id=CVE-2011-4759
Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. Parallels Plesk Small Business Panel 10.2.0 genera páginas web que contienen enlaces externos en respuesta a peticiones GET con peticiones de búsqueda de "client@1/domain@1/hosting/file-manager/" y otros archivos determinados, lo que facilita a atacantes remotos obtener información confidencial leyendo (1) los logs de acceso o (2) Referer del servidor web, relacionado con una filtración de Referer entre dominios. • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72211 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-4761
https://notcve.org/view.php?id=CVE-2011-4761
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files. NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue. Parallels Plesk Small Business Panel 10.2.0 omite el parámetro charset de cabeceras Content-Type para determinados recursos, lo que podría permitir a atacantes remotos tener un impacto sin especificar utilizando un conflicto de interpretación que involucre "domains/sitebuilder_edit.php" y otros archivos concretos. NOTA: es posible que sólo clientes, no el producto SmarterStats, podrían estar afectados por este problema. • http://xss.cx/examples/plesk-reports/plesk-10.2.0.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72213 •