CVEs

346,473 total · page 5960 of 6,930

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-4141	Rsa Securid	0.00	—	0.02	Dec 17, 2011	Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Software Token file.
CVE-2011-3339	Safenet Sentinel Hasp Run Time	0.00	—	0.01	Dec 17, 2011	Cross-site scripting (XSS) vulnerability in the Admin Control Center in Sentinel HASP Run-time Environment 5.95 and earlier in SafeNet Sentinel HASP (formerly Aladdin HASP SRM) run-time installer before 6.x and SDK before 5.11, as used in 7 Technologies (7T) IGSS 7 and other…
CVE-2011-4857	Winamp Winamp	0.00	—	0.05	Dec 16, 2011	Heap-based buffer overflow in the in_mod.dll plugin in Winamp before 5.623 allows remote attackers to execute arbitrary code via crafted song message data in an Impulse Tracker (IT) file. NOTE: some of these details are obtained from third party information.
CVE-2011-4369	Adobe Inc. Acrobat	0.01	—	0.08	Dec 16, 2011	Unspecified vulnerability in the PRC component in Adobe Reader and Acrobat 9.x before 9.4.7 on Windows, Adobe Reader and Acrobat 9.x through 9.4.6 on Mac OS X, Adobe Reader and Acrobat 10.x through 10.1.1 on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX allows…
CVE-2011-3834	Winamp Winamp	0.00	—	0.05	Dec 16, 2011	Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
CVE-2011-4856	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain…
CVE-2011-4855	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4854	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation…
CVE-2011-4853	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain…
CVE-2011-4852	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive…
CVE-2011-4851	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in…
CVE-2011-4850	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by…
CVE-2011-4849	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies…
CVE-2011-4848	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under…
CVE-2011-4847	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/.
CVE-2011-4777	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.
CVE-2011-4776	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other…
CVE-2011-4768	Parallels Parallels Plesk Small Business Panel	0.00	—	0.02	Dec 16, 2011	The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4767	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive…
CVE-2011-4766	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allows remote attackers to obtain ASP source code via a direct request to wysiwyg/fckconfig.js. NOTE: CVE disputes this issue because ASP is only used in a JavaScript comment
CVE-2011-4765	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this…
CVE-2011-4764	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by…
CVE-2011-4763	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other…
CVE-2011-4762	Parallels Parallels Plesk Small Business Panel	0.00	—	0.02	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files. …
CVE-2011-4761	Parallels Parallels Plesk Small Business Panel	0.00	—	0.02	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other…
CVE-2011-4760	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by…
CVE-2011-4759	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive…
CVE-2011-4758	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files.
CVE-2011-4757	Parallels Parallels Plesk Small Business Panel	0.00	—	0.02	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain…
CVE-2011-4756	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by…
CVE-2011-4755	Parallels Parallels Plesk Small Business Panel	0.00	—	0.02	Dec 16, 2011	Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as…
CVE-2011-4754	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files.
CVE-2011-4753	Parallels Parallels Plesk Small Business Panel	0.00	—	0.01	Dec 16, 2011	Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files.
CVE-2011-4752	Smartertools Smarterstats	0.00	—	0.02	Dec 16, 2011	SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files. NOTE: it is possible…
CVE-2011-4751	Smartertools Smarterstats	0.00	—	0.01	Dec 16, 2011	SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2)…
CVE-2011-4750	Smartertools Smarterstats	0.00	—	0.01	Dec 16, 2011	Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Default.aspx and certain other files.
CVE-2011-4749	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by…
CVE-2011-4748	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading…
CVE-2011-4747	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not prevent the use of weak ciphers for SSL sessions, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a crafted CipherSuite list.
CVE-2011-4746	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses.
CVE-2011-4745	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain…
CVE-2011-4744	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4743	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and…
CVE-2011-4742	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a…
CVE-2011-4741	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by client@2/domain@1/hosting/aspdotnet/.
CVE-2011-4740	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to…
CVE-2011-4739	Parallels Parallels Plesk Panel	0.00	—	0.02	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms…
CVE-2011-4738	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by…
CVE-2011-4737	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in…
CVE-2011-4736	Parallels Parallels Plesk Panel	0.00	—	0.01	Dec 16, 2011	The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in login_up.php3 and certain other files.

CVE-2011-4141Dec 17, 2011
Rsa
Securid
risk 0.00cvss —epss 0.02
Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Software Token file.
CVE-2011-3339Dec 17, 2011
Safenet
Sentinel Hasp Run Time
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Admin Control Center in Sentinel HASP Run-time Environment 5.95 and earlier in SafeNet Sentinel HASP (formerly Aladdin HASP SRM) run-time installer before 6.x and SDK before 5.11, as used in 7 Technologies (7T) IGSS 7 and other…
CVE-2011-4857Dec 16, 2011
Winamp
Winamp
risk 0.00cvss —epss 0.05
Heap-based buffer overflow in the in_mod.dll plugin in Winamp before 5.623 allows remote attackers to execute arbitrary code via crafted song message data in an Impulse Tracker (IT) file. NOTE: some of these details are obtained from third party information.
CVE-2011-4369Dec 16, 2011
Adobe Inc.
Acrobat
risk 0.01cvss —epss 0.08
Unspecified vulnerability in the PRC component in Adobe Reader and Acrobat 9.x before 9.4.7 on Windows, Adobe Reader and Acrobat 9.x through 9.4.6 on Mac OS X, Adobe Reader and Acrobat 10.x through 10.1.1 on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX allows…
CVE-2011-3834Dec 16, 2011
Winamp
Winamp
risk 0.00cvss —epss 0.05
Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
CVE-2011-4856Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain…
CVE-2011-4855Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4854Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation…
CVE-2011-4853Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain…
CVE-2011-4852Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive…
CVE-2011-4851Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in…
CVE-2011-4850Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by…
CVE-2011-4849Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies…
CVE-2011-4848Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under…
CVE-2011-4847Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/.
CVE-2011-4777Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.
CVE-2011-4776Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other…
CVE-2011-4768Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.02
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4767Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive…
CVE-2011-4766Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allows remote attackers to obtain ASP source code via a direct request to wysiwyg/fckconfig.js. NOTE: CVE disputes this issue because ASP is only used in a JavaScript comment
CVE-2011-4765Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this…
CVE-2011-4764Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by…
CVE-2011-4763Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other…
CVE-2011-4762Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.02
Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files. …
CVE-2011-4761Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.02
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other…
CVE-2011-4760Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by…
CVE-2011-4759Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive…
CVE-2011-4758Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files.
CVE-2011-4757Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.02
Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain…
CVE-2011-4756Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by…
CVE-2011-4755Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.02
Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as…
CVE-2011-4754Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files.
CVE-2011-4753Dec 16, 2011
Parallels
Parallels Plesk Small Business Panel
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files.
CVE-2011-4752Dec 16, 2011
Smartertools
Smarterstats
risk 0.00cvss —epss 0.02
SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files. NOTE: it is possible…
CVE-2011-4751Dec 16, 2011
Smartertools
Smarterstats
risk 0.00cvss —epss 0.01
SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2)…
CVE-2011-4750Dec 16, 2011
Smartertools
Smarterstats
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Default.aspx and certain other files.
CVE-2011-4749Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by…
CVE-2011-4748Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading…
CVE-2011-4747Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not prevent the use of weak ciphers for SSL sessions, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a crafted CipherSuite list.
CVE-2011-4746Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses.
CVE-2011-4745Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain…
CVE-2011-4744Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving…
CVE-2011-4743Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and…
CVE-2011-4742Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a…
CVE-2011-4741Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by client@2/domain@1/hosting/aspdotnet/.
CVE-2011-4740Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to…
CVE-2011-4739Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.02
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms…
CVE-2011-4738Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by…
CVE-2011-4737Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in…
CVE-2011-4736Dec 16, 2011
Parallels
Parallels Plesk Panel
risk 0.00cvss —epss 0.01
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in login_up.php3 and certain other files.