CVE-2011-4733
HighSummary
Panel administracyjny serwera w Parallels Plesk Panel 10.2.0_build1011110331.18 wysyła nieprawidłowe nagłówki Content-Type dla niektórych zasobów, co może umożliwić zdalnym atakującym wykorzystanie konfliktu interpretacji dotyczącego smb/admin-home/disable-featured-applications-promo oraz innych plików. Możliwe, że problem dotyczy tylko klientów, a nie samego produktu Plesk.
Risk Assessment
Ryzyko dla organizacji polega na możliwości wykorzystania tej podatności przez zdalnych atakujących, co może prowadzić do nieautoryzowanego dostępu lub innych niepożądanych skutków. Wpływ może być ograniczony do klientów, co może wpłynąć na ich zaufanie do usługi.
Recommendation
Zaleca się aktualizację do najnowszej wersji Parallels Plesk Panel, aby usunąć tę podatność. Należy również monitorować i analizować logi serwera w celu wykrycia potencjalnych prób ataków.
Related vulnerabilities
- CVE-2026-81855Critical
A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.
- CVE-2026-78225Critical
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.
- CVE-2026-73807Critical
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
- CVE-2026-73437Critical
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source.
- CVE-2026-61560Critical
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project.
- CVE-2026-91939Critical
Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads to trigger gadget chains and achieve database manipulation or code execution.
- CVE-2026-91749Critical
Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-91728Critical
Integer overflow in V8 in Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-68491Critical
An insufficient check allowed for the overwrite of arbitrary files via a symlink. Technical details were not provided in the description.
- CVE-2026-66890Critical
The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. Technical details were not provided in the description.
Original NVD description (English source)
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and certain other files. NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.