deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4741
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by client@2/domain@1/hosting/aspdotnet/.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72318; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4742
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/user/list and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72317; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4743
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72316; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4744
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/featured-applications/ and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72315; http://xss.cx/examples/plesk-reports/xss-reflected-cross-site-scripting-cwe79-capec86-plesk-parallels-control-panel-version-20110407.20.html
CVE: CVE-2011-4745
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build[PII_REDACTED].09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72264; http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
CVE: CVE-2011-4746
Published: 2011-12-16
Description: The billing system for Parallels Plesk Panel 10.3.1_build[PII_REDACTED].09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html; http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
CVE: CVE-2011-4747
Published: 2011-12-16
Description: The billing system for Parallels Plesk Panel 10.3.1_build[PII_REDACTED].09 does not prevent the use of weak ciphers for SSL sessions, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a crafted CipherSuite list.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72262; http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
CVE: CVE-2011-4748
Published: 2011-12-16
Description: The billing system for Parallels Plesk Panel 10.3.1_build[PII_REDACTED].09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/ajax/core/ajax.inc.js and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72261; http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
CVE: CVE-2011-4749
Published: 2011-12-16
Description: The billing system for Parallels Plesk Panel 10.3.1_build[PII_REDACTED].09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72260; http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build[PII_REDACTED].09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
CVE: CVE-2011-4750
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Default.aspx and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-4751
Published: 2011-12-16
Description: SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72203; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-4752
Published: 2011-12-16
Description: SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72204; http://xss.cx/examples/exploits/stored-reflected-xss-cwe79-smarterstats624100.html
CVE: CVE-2011-4753
Published: 2011-12-16
Description: Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72205; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4754
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72206; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4755
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as demonstrated by cookies to client@1/domain@1/hosting/file-manager/ and certain other files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72207; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4756
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72208; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4757
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain other files.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72209; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4758
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72210; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4759
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72211; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4760
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/email-address/list and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72212; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4761
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72213; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4762
Published: 2011-12-16
Description: Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72214; http://xss.cx/examples/plesk-reports/plesk-10.2.0.html
CVE: CVE-2011-4763
Published: 2011-12-16
Description: Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72215; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4764
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72216; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4765
Published: 2011-12-16
Description: The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72217; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4766
Published: 2011-12-16
Description: The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allows remote attackers to obtain ASP source code via a direct request to wysiwyg/fckconfig.js.  NOTE: CVE disputes this issue because ASP is only used in a JavaScript comment
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4767
Published: 2011-12-16
Description: The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/Wizard/Status.js and certain other files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72218; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4768
Published: 2011-12-16
Description: The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving Wizard/Edit/Modules/Image and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
CVSS Score: 10.0 (HIGH)
References: http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html; http://xss.cx/examples/plesk-reports/plesk-10.2.0-site-editor.html
CVE: CVE-2011-4776
Published: 2011-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72220; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4777
Published: 2011-12-16
Description: Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4847
Published: 2011-12-16
Description: SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72222; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4848
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72223; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4849
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72224; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4850
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by help.php and certain other files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html
CVE: CVE-2011-4851
Published: 2011-12-16
Description: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files.
CVSS Score: 9.3 (HIGH)
CWE: CWE-255
References: http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/72226; http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html