Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-201112-0194 CVE-2011-4731 Parallels Plesk Panel Information Disclosure Vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files
VAR-201112-0193 CVE-2011-4730 Parallels Plesk Panel of Server Administration Panel Vulnerabilities that bypass authentication CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in admin/reseller/login-info/ and certain other files
VAR-201112-0192 CVE-2011-4729 Parallels Plesk Panel of Server Administration Panel Vulnerability in which important information is obtained CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files
VAR-201112-0191 CVE-2011-4728 Parallels Plesk Panel Information Disclosure Vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by login_up.php3 and certain other files
VAR-201112-0197 CVE-2011-4734 Parallels Plesk Panel of Control Panel In SQL Injection vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files
VAR-201112-0198 CVE-2011-4735 Parallels Plesk Panel Cross-Site Scripting Vulnerability CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files
VAR-201112-0257 CVE-2011-4764 Parallels Plesk Small Business Panel Multiple Cross-Site Scripting Vulnerabilities CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain other files. As evidenced in Wizard/Edit/Modules/Image and some other files
VAR-201112-0218 CVE-2011-4755 Parallels Plesk Small Business Panel Input Validation Vulnerability CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as demonstrated by cookies to client@1/domain@1/hosting/file-manager/ and certain other files. As evidenced by cookies in client @ 1 / domain @ 1 / hosting / file-manager / and some other files. Parallels Plesk Small Business Panel is prone to a denial-of-service vulnerability
VAR-201112-0217 CVE-2011-4754 Parallels Plesk Small Business Panel Cross-Site Scripting Vulnerability CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files
VAR-201112-0208 CVE-2011-4745 Parallels Plesk Panel Multiple Cross-Site Scripting Vulnerabilities CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files
VAR-201112-0241 CVE-2011-4847 Parallels Plesk Panel SQL Injection Vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/
VAR-201112-0188 CVE-2011-4725 Parallels Plesk Panel of Server Administration Panel In SQL Injection vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files
VAR-201112-0263 CVE-2011-4777 Parallels Plesk Panel of Site Editor Cross-site scripting vulnerability in functionality CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html
VAR-201112-0262 CVE-2011-4776 Parallels Plesk Panel Cross-Site Scripting Vulnerability CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files
VAR-201112-0222 CVE-2011-4759 Parallels Plesk Small Business Panel Information Disclosure Vulnerability CVSS V2: 5.0
CVSS V3: -
Severity: MEDIUM
Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. The vulnerability is related to the "cross-domain Referer leakage" problem
VAR-201112-0220 CVE-2011-4757 Parallels Plesk Small Business Panel Trust Management Vulnerability CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain other files. Remote attackers can bypass authentication by using unattended workstations, as evidenced by forms in smb / auth and some other documents
VAR-201112-0189 CVE-2011-4726 Parallels Plesk Panel Cross-Site Scripting Vulnerability CVSS V2: 4.3
CVSS V3: -
Severity: MEDIUM
Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files
VAR-201112-0216 CVE-2011-4753 Parallels Plesk Small Business Panel SQL Injection Vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files
VAR-201112-0226 CVE-2011-4763 Parallels Plesk Small Business Panel of Site Editor In function SQL Injection vulnerability CVSS V2: 7.5
CVSS V3: -
Severity: HIGH
Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files. As demonstrated in Wizard / Edit / Html and some other documents. Parallels Plesk Small Business Panel is prone to a sql-injection vulnerability
VAR-201112-0190 CVE-2011-4727 Parallels Plesk Panel Input validation vulnerability CVSS V2: 10.0
CVSS V3: -
Severity: HIGH
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files. Parallels Plesk Panel is prone to a denial-of-service vulnerability