CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4851
https://notcve.org/view.php?id=CVE-2011-4851
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 genera un campo de formulario de contraseña sin deshabilitar el autocompletado, lo que facilita a atacantes remotos eviar la autenticación accediendo a un ordenador desatendido. Tal como se ha demostrado por formularios en "server/google-tools/" y otros archivos determinados. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72226 • CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4848
https://notcve.org/view.php?id=CVE-2011-4848
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 incluye una contraseña suministrada ("submitted") dentro del cuerpo de la respuesta HTTP, lo que facilita a atacantes remotos obtener información confidencial interceptando el tráfico de red. Tal como se ha demostrado por el manejo de la contraseña en determinados archivos bajo client@1/domain@1/backup/local-repository/. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72223 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2011-4853
https://notcve.org/view.php?id=CVE-2011-4853
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 incluye una dirección IP RFC 1918 IP dentro de una página web, lo que permite a atacanes remotos obtener información confidencial leyendo esta página, tal como se ha demostrado por "smb/user/list-data/items-per-page/" y otros archivos determinados. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72094 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4776
https://notcve.org/view.php?id=CVE-2011-4776
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files. Múltiples vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el panel de control de Parallels Plesk Panel 10.4.4_build20111103.18. Permiten a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de datos de entrada modificados a un PHP. Tal como se ha demostrado por admin/update/settings/ y otros determinados archivos. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72220 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2011-4854
https://notcve.org/view.php?id=CVE-2011-4854
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the get_enabled_product_icon program. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue. El panel de control de Parallels Plesk Panel 10.4.4_build20111103.18 no se asegura de que las cabeceras HTTP Content-Type coinciden con los datos Content-Type correspondientes en elementos HTML META, lo que permite a atacantes remotos tener un impacto sin especificar basándose en un conflicto de interpretación que involucre el programa get_enabled_product_icon. NOTA: es posible que sólo clientes, no el producto Plesk, esten afectados. • http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html https://exchange.xforce.ibmcloud.com/vulnerabilities/72093 •