Vulnerabilities > Parallels > Parallels Plesk Panel > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-07-18 | CVE-2013-4878 | Permissions, Privileges, and Access Controls vulnerability in Parallels products The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823. | 7.5 |
| 2013-04-18 | CVE-2013-0133 | Unspecified vulnerability in Parallels Plesk Panel 11.0.9 Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable. | 7.2 |
| 2012-03-12 | CVE-2012-1557 | SQL Injection vulnerability in Parallels Plesk Panel SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012. | 7.5 |
| 2011-12-16 | CVE-2011-4847 | SQL Injection vulnerability in Parallels Plesk Panel 10.4.4Build20111103.18 SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/. | 7.5 |
| 2011-12-16 | CVE-2011-4734 | SQL Injection vulnerability in Parallels Plesk Panel 10.2.0Build20110407.20 Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files. | 7.5 |
| 2011-12-16 | CVE-2011-4725 | SQL Injection vulnerability in Parallels Plesk Panel 10.2.0Build1011110331.18 Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files. | 7.5 |