deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4516
Published: 2011-12-15
Description: Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html
CVE: CVE-2011-4517
Published: 2011-12-15
Description: The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html
CVE: CVE-2011-4597
Published: 2011-12-15
Description: The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2011-12/0151.html; http://downloads.asterisk.org/pub/security/AST-2011-013.html; http://lists.digium.com/pipermail/asterisk-dev/2011-November/052191.html
CVE: CVE-2011-4598
Published: 2011-12-15
Description: The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://downloads.asterisk.org/pub/security/AST-2011-014.html; http://openwall.com/lists/oss-security/2011/12/09/3; http://openwall.com/lists/oss-security/2011/12/09/4
CVE: CVE-2011-4606
Published: 2011-12-15
Description: Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651620; http://openwall.com/lists/oss-security/2011/12/12/2; http://openwall.com/lists/oss-security/2011/12/12/3
CVE: CVE-2011-4822
Published: 2011-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://confluence.atlassian.com/display/FISHEYE/FishEye+and+Crucible+Security+Advisory+2011-11-22; http://osvdb.org/77263; http://osvdb.org/77264
CVE: CVE-2011-4823
Published: 2011-12-15
Description: Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://docs.joomla.org/Vulnerable_Extensions_List#Vik_Real_Estate_1.0; http://www.exploit-db.com/exploits/18048; http://docs.joomla.org/Vulnerable_Extensions_List#Vik_Real_Estate_1.0
CVE: CVE-2011-4824
Published: 2011-12-15
Description: SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.cacti.net/view.php?id=2062; http://forums.cacti.net/viewtopic.php?f=21&t=44116; http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069126.html
CVE: CVE-2011-4825
Published: 2011-12-15
Description: Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/18075; http://www.phpletter.com/en/DOWNLOAD/1/; http://www.phpmyfaq.de/advisory_2011-10-25.php
CVE: CVE-2011-4826
Published: 2011-12-15
Description: SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/46861; http://www.autosectools.com/Advisory/V-CMS-1.0-SQL-Injection-235; http://www.securityfocus.com/bid/50706
CVE: CVE-2011-4827
Published: 2011-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in AutoSec Tools V-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) p parameter to redirect.php and (2) box parameter to includes/TrueColorPicker/index.php, which is not properly handled in includes/TrueColorPicker/class.TrueColorPicker.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46861; http://www.autosectools.com/Advisory/V-CMS-1.0-Reflected-Cross-site-Scripting-234; http://www.securityfocus.com/bid/50706
CVE: CVE-2011-4828
Published: 2011-12-15
Description: Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://bugs.v-cms.org/changelog_page.php; http://bugs.v-cms.org/view.php?id=53; http://secunia.com/advisories/46861
CVE: CVE-2011-4829
Published: 2011-12-15
Description: SQL injection vulnerability in the com_listing component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://docs.joomla.org/Vulnerable_Extensions_List#Barter_Sites_1.3; http://my.barter-sites.com/index.php?option=com_content&view=article&id=6&Itemid=25; http://www.exploit-db.com/exploits/18046
CVE: CVE-2011-4830
Published: 2011-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the com_listing component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the (1) listing_title, (2) description, (3) homeurl (aka Website Address), (4) paystring (aka Payment types accepted), (5) sell_price, (6) shipping_cost, and (7) quantity parameters to index.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://docs.joomla.org/Vulnerable_Extensions_List#Barter_Sites_1.3; http://my.barter-sites.com/index.php?option=com_content&view=article&id=6&Itemid=25; http://www.exploit-db.com/exploits/18046
CVE: CVE-2011-4831
Published: 2011-12-15
Description: Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to read arbitrary files via a ..%2f (encoded dot dot) in the file parameter in a download action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18070; http://www.exploit-db.com/exploits/18070
CVE: CVE-2011-4832
Published: 2011-12-15
Description: Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/46704; http://www.exploit-db.com/exploits/18066; http://www.osvdb.org/76871
CVE: CVE-2011-4833
Published: 2011-12-15
Description: Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/47011; http://securitytracker.com/id?1026369; http://www.osvdb.org/77459
CVE: CVE-2011-4834
Published: 2011-12-15
Description: The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://0a29.blogspot.com/2011/12/0a29-11-2-privilege-escalation.html; http://secunia.com/advisories/47040; http://www.securityfocus.com/archive/1/520783/100/0/threaded
CVE: CVE-2011-4835
Published: 2011-12-15
Description: Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/796883; http://www.kb.cert.org/vuls/id/796883
CVE: CVE-2011-4836
Published: 2011-12-15
Description: Cross-site scripting (XSS) vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to inject arbitrary web script or HTML via a request for a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/796883; http://www.kb.cert.org/vuls/id/796883
CVE: CVE-2011-4837
Published: 2011-12-15
Description: Cross-site request forgery (CSRF) vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www.kb.cert.org/vuls/id/796883; http://www.kb.cert.org/vuls/id/796883
CVE: CVE-2011-4725
Published: 2011-12-16
Description: Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72334; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4726
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72333; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4727
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72332; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4728
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by login_up.php3 and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72331; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4729
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files.
CVSS Score: 5.0 (MEDIUM)
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72330; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4730
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in admin/reseller/login-info/ and certain other files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72329; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4731
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4732
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72327; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4733
Published: 2011-12-16
Description: The Server Administration Panel in Parallels Plesk Panel 10.2.0_build[PII_REDACTED].18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72326; http://xss.cx/examples/plesk-reports/plesk-redhat-el6-psa-10.2.0-build[PII_REDACTED].18-xss-sqli-cwe79-cwe89-javascript-injection-exception-example-poc-report-paros-burp-suite-pro-1.4.1.html
CVE: CVE-2011-4734
Published: 2011-12-16
Description: Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72325; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4735
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/541814; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72324
CVE: CVE-2011-4736
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in login_up.php3 and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72323; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4737
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72322; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4738
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by get_password.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72321; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4739
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/my-profile and certain other files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72320; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4740
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72319; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html