 |  |
||||||||||||||||||
 | Acunetix Website Audit 24 September, 2011 |
||||||||||||||||||
| Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6 Report | |||||||||||||||||||
| Generated by Acunetix WVS Reporter (v7.0 Build 20110920) | |||||||||||||||||||
| Scan of https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ | |||||||||||||||||||
| Scan details | |||||||||||||||||||
| Scan information | |||||||||||||||||||
| Starttime | 9/24/2011 2:26:03 PM | ||||||||||||||||||
| Finish time | 9/24/2011 3:20:59 PM | ||||||||||||||||||
| Scan time | 54 minutes, 56 seconds | ||||||||||||||||||
| Profile | Default | ||||||||||||||||||
| Server information | |||||||||||||||||||
| Responsive | True | ||||||||||||||||||
| Server banner | sw-cp-server | ||||||||||||||||||
| Server OS | Unknown | ||||||||||||||||||
| Server technologies | |||||||||||||||||||
| Threat level | |||||||||||||||||||
 | Acunetix Threat Level 3 One or more high-severity type vulnerabilities have been discovered by the scanner. A malicious user can exploit these vulnerabilities and compromise the backend database and/or deface your website. |
||||||||||||||||||
| Alerts distribution | |||||||||||||||||||
| Total alerts found | 26 | ||||||||||||||||||
 | High | 1 | |||||||||||||||||
 | Medium | 3 | |||||||||||||||||
 | Low | 5 | |||||||||||||||||
 | Informational | 17 | |||||||||||||||||
| Knowledge base | |||||||||||||||||||
| List of open TCP ports | |||||||||||||||||||
Open Port 22 / ssh Port Banner: SSH-2.0-OpenSSH_5.3 Open Port 21 / ftp Port Banner: ProFTPD 1.3.3c Server (ProFTPD) [50.97.148.210] Open Port 53 / domain No port banner available. Open Port 80 / http Port Banner: HTTP/1.1 200 OK: Sat, 24 Sep 2011 14:24:56 GMT: ApacheModified: Sat, 24 Sep 2011 12:13:32 GMT: "2071-27d6-4adaedab43300"Ranges: bytesLength: 10198: closeType: text/html <!DOCTYPE ... |
|||||||||||||||||||
| Acunetix Website Audit | 2 | ||||||||||||||||||
Open Port 106 / pop3pw Port Banner: poppassd hello, who are you? Open Port 110 / pop3 Port Banner: +OK Hello there. <17942.1316874296@localhost.localdomain> Open Port 143 / imap Port Banner: * OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyright 1998-2004 Double Precision, Inc. See COPYING for distribution information. Open Port 443 / https Port Banner: <HTML> <HEAD> <TITLE>400 Bad Request</TITLE> </HEAD> <BODY> <H1>Bad Request</H1> browser sent a request that this server could not understand. <P> sent malformed Host header <P> <HR> <ADDRESS> Server at nosedivesailing.com </ADDRESS> ... Open Port 465 / smtps No port banner available. Open Port 993 / imaps No port banner available. Open Port 995 / pop3s No port banner available. Open Port 3306 / mysql Port Banner: F |
|||||||||||||||||||
| DNS server running | |||||||||||||||||||
| A DNS server is running on UDP port 53. | |||||||||||||||||||
| DNS server running on TCP | |||||||||||||||||||
| A DNS server is running on TCP port 53. | |||||||||||||||||||
| FTP server running | |||||||||||||||||||
| An FTP server is running on TCP port 21. | |||||||||||||||||||
| IMAP server running | |||||||||||||||||||
| An IMAP server is running on TCP port 143. | |||||||||||||||||||
| Whois lookup | |||||||||||||||||||
| Whois result for IP address 50.97.148.210: |
|||||||||||||||||||
| Acunetix Website Audit | 3 | ||||||||||||||||||
| % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '0.0.0.0 - 255.255.255.255' : 0.0.0.0 - 255.255.255.255: IANA-BLK: The whole IPv4 address space: EU # Country is really world wide: ORG-IANA1-RIPEc: IANA1-RIPEc: IANA1-RIPE: ALLOCATED UNSPECIFIED: The country is really worldwide.: This address space is assigned at various other places in: the world and might therefore not be in the RIPE database.by: RIPE-NCC-HM-MNTlower: RIPE-NCC-HM-MNTroutes: RIPE-NCC-RPSL-MNT: RIPE # Filtered : ORG-IANA1-RIPEname: Internet Assigned Numbers Authoritytype: IANA: see http://www.iana.org: The IANA allocates IP addresses and AS number blocks to RIRs: see http://www.iana.org/ipaddress/ip-addresses.htm: and http://www.iana.org/assignments/as-numbersmail: bitbucket@ripe.netc: IANA1-RIPEc: IANA1-RIPEref: RIPE-NCC-HM-MNTby: RIPE-NCC-HM-MNT: RIPE # Filtered : Internet Assigned Numbers Authority: see http://www.iana.org.mail: bitbucket@ripe.netc: IANA1-RIPEc: IANA1-RIPEhdl: IANA1-RIPE: For more information on IANA services: go to IANA web site at http://www.iana.org.by: RIPE-NCC-MNT: RIPE # Filtered |
|||||||||||||||||||
| POP3 server running | |||||||||||||||||||
| A POP3 server is running on TCP port 110. | |||||||||||||||||||
| SSH server running | |||||||||||||||||||
| A SSH server is running on TCP port 22. SSH server information: Server key fingerprint: 61a1ceca0a253ba1cc41ba43e9078c53 version: SSH2 algorithm client to server: AES128 CTR algorithm server to client: AES128 CTR algorithm client to server: HMAC with SHA-256 digest algorithm server to client: HMAC with SHA-256 digest key algorithm: Certificate is signed using RSA digital signature with MD2 digest |
|||||||||||||||||||
| SSL server running [443] | |||||||||||||||||||
A SSL2 server is running on TCP port 443. SSL server information: Version: SSL2,SSL3,TLS1 Certificate: : Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels Organizational Unit Name: Parallels Panel Common Name: Parallels Panel: Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels |
|||||||||||||||||||
| Acunetix Website Audit | 4 | ||||||||||||||||||
| Organizational Unit Name: Parallels Panel Common Name: Parallels Panel version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33 CDT 2012 in: 364 days A SSL3 server is running on TCP port 443. SSL server information: Version: SSL2,SSL3,TLS1 Ciphers suported: - SSL3_CK_RSA_RC4_40_MD5(OpenSSL ciphername: EXP-RC4-MD5, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC4(40), Message authentication code: MD5, export) - Low strength - SSL3_CK_RSA_RC4_128_MD5(OpenSSL ciphername: RC4-MD5, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: MD5) - High strength - SSL3_CK_RSA_RC4_128_SHA(OpenSSL ciphername: RC4-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: SHA1) - High strength - SSL3_CK_RSA_RC2_40_MD5(OpenSSL ciphername: EXP-RC2-CBC-MD5, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC2(40), Message authentication code: MD5, export) - Low strength - SSL3_CK_RSA_DES_40_CBC_SHA(OpenSSL ciphername: EXP-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength - SSL3_CK_RSA_DES_64_CBC_SHA(OpenSSL ciphername: DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength - SSL3_CK_RSA_DES_192_CBC3_SHA(OpenSSL ciphername: DES-CBC3-SHA, Protocol version: SSLv3, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength - SSL3_CK_EDH_RSA_DES_40_CBC_SHA(OpenSSL ciphername: EXP-EDH-RSA-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: DH(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength - SSL3_CK_EDH_RSA_DES_64_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC-SHA, Protocol version: SSLv3, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength - SSL3_CK_EDH_RSA_DES_192_CBC3_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC3-SHA, Protocol version: SSLv3, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength Certificate: : Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels Organizational Unit Name: Parallels Panel Common Name: Parallels Panel: Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels Organizational Unit Name: Parallels Panel Common Name: Parallels Panel version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33 |
|||||||||||||||||||
| Acunetix Website Audit | 5 | ||||||||||||||||||
| CDT 2012 in: 364 days A TLS1 server is running on TCP port 443. SSL server information: Version: SSL2,SSL3,TLS1 Ciphers suported: - TLS1_CK_RSA_EXPORT_WITH_RC4_40_MD5(OpenSSL ciphername: EXP-RC4-MD5, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC4(40), Message authentication code: MD5, export) - Low strength - TLS1_CK_RSA_WITH_RC4_128_MD5(OpenSSL ciphername: RC4-MD5, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: MD5) - High strength - TLS1_CK_RSA_WITH_RC4_128_SHA(OpenSSL ciphername: RC4-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: RC4(128), Message authentication code: SHA1) - High strength - TLS1_CK_RSA_EXPORT_WITH_RC2_CBC_40_MD5(OpenSSL ciphername: EXP-RC2-CBC-MD5, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: RC2(40), Message authentication code: MD5, export) - Low strength - TLS1_CK_RSA_EXPORT_WITH_DES40_CBC_SHA(OpenSSL ciphername: EXP-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: RSA(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength - TLS1_CK_RSA_WITH_DES_CBC_SHA(OpenSSL ciphername: DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength - TLS1_CK_RSA_WITH_3DES_EDE_CBC_SHA(OpenSSL ciphername: DES-CBC3-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA(OpenSSL ciphername: EXP-EDH-RSA-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: DH(512), Autentication: RSA, Symmetric encryption method: DES(40), Message authentication code: SHA1, export) - Low strength - TLS1_CK_DHE_RSA_WITH_DES_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: DES(56), Message authentication code: SHA1) - Low strength - TLS1_CK_DHE_RSA_WITH_3DES_EDE_CBC_SHA(OpenSSL ciphername: EDH-RSA-DES-CBC3-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: 3DES(168), Message authentication code: SHA1) - High strength - TLS1_CK_RSA_WITH_AES_128_CBC_SHA(OpenSSL ciphername: AES128-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: AES(128), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_WITH_AES_128_CBC_SHA(OpenSSL ciphername: DHE-RSA-AES128-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: AES(128), Message authentication code: SHA1) - High strength - TLS1_CK_RSA_WITH_AES_256_CBC_SHA(OpenSSL ciphername: AES256-SHA, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: AES(256), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_WITH_AES_256_CBC_SHA(OpenSSL ciphername: DHE-RSA-AES256-SHA, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: AES(256), Message authentication code: SHA1) - High strength - TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: Camellia(128), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: Camellia(128), Message authentication code: SHA1) - High strength - TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: Camellia(256), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: Camellia(256), Message authentication code: SHA1) - |
|||||||||||||||||||
| Acunetix Website Audit | 6 | ||||||||||||||||||
| High strength - TLS1_CK_RSA_WITH_SEED_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: RSA, Autentication: RSA, Symmetric encryption method: SEED(128), Message authentication code: SHA1) - High strength - TLS1_CK_DHE_RSA_WITH_SEED_CBC_SHA(OpenSSL ciphername: n/a, Protocol version: TLSv1, Key Exchange: DH, Autentication: RSA, Symmetric encryption method: SEED(128), Message authentication code: SHA1) - High strength Certificate: : Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels Organizational Unit Name: Parallels Panel Common Name: Parallels Panel: Country Name: US State Or Province Name: Virginia Locality Name: Herndon Organization Name: Parallels Organizational Unit Name: Parallels Panel Common Name: Parallels Panel version: 1 number: 4e7d480d print: 440e783632f21b4b162208187c4c470d ID: 1.2.840.113549.1.1.5 start: Fri Sep 23 22:01:33 CDT 2011 end: Sat Sep 22 22:01:33 CDT 2012 in: 364 days |
|||||||||||||||||||
| List of file extensions | |||||||||||||||||||
| File extensions can provide information on what technologies are being used on this website. List of file extensions detected: php3 => 6 file(s) js => 12 file(s) php => 3 file(s) htc => 1 file(s) ico => 1 file(s) css => 23 file(s) gif => 1004 file(s) png => 109 file(s) html => 1 file(s) asp => 1 file(s) jsp => 2 file(s) aspx => 1 file(s) admin => 1 file(s) reseller => 1 file(s) |
|||||||||||||||||||
| List of files with inputs | |||||||||||||||||||
| These files have at least one input (GET or POST). / - 1 inputs /javascript/chk.js.php - 1 inputs /login_up.php3 - 2 inputs /get_password.php - 1 inputs /smb/account/create-subscription - 1 inputs /admin/home - 1 inputs /admin/customer/list - 2 inputs /admin/reseller/list - 2 inputs /admin/reseller/tools/id/3 - 1 inputs /admin/reseller/personal-info - 1 inputs |
|||||||||||||||||||
| Acunetix Website Audit | 7 | ||||||||||||||||||
| /admin/reseller/login-info - 1 inputs /admin/domain/list - 1 inputs /admin/subscription/list - 2 inputs /admin/subscription/login - 1 inputs /admin/customer-service-plan/list - 1 inputs /admin/server/tools - 1 inputs /admin/server/settings - 1 inputs /admin/health - 1 inputs /admin/health/index - 1 inputs /plesk/modules - 1 inputs /plesk/admin-info - 1 inputs /plesk/admin-password - 1 inputs /plesk/client@2/domain@1/hosting/file-manager - 1 inputs /plesk/reseller@3/preferences - 1 inputs |
|||||||||||||||||||
| List of external hosts | |||||||||||||||||||
| These hosts were linked from this website but they were not scanned because they are not listed in the list of hosts allowed.(Settings->Scanners settings->Scanner->List of hosts allowed). www.parallels.com |
|||||||||||||||||||
| Alerts summary | |||||||||||||||||||
 | SSL 2.0 deprecated protocol | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| Server | 1 | ||||||||||||||||||
 | SSL weak ciphers | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| Server | 2 | ||||||||||||||||||
 | TLS1/SSLv3 Renegotiation Vulnerability | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| Web Server | 1 | ||||||||||||||||||
 | Login page password-guessing attack | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| /login_up.php3 | 1 | ||||||||||||||||||
 | Session Cookie without HttpOnly flag set | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| / | 2 | ||||||||||||||||||
 | Session Cookie without Secure flag set | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| / | 2 | ||||||||||||||||||
| Acunetix Website Audit | 8 | ||||||||||||||||||
 | Broken links | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| /account | 1 | ||||||||||||||||||
| /account/power-mode-logout | 1 | ||||||||||||||||||
| /javascript | 1 | ||||||||||||||||||
| /javascript/main.leie7.fixes.js | 1 | ||||||||||||||||||
| /plesk | 1 | ||||||||||||||||||
| /skins | 1 | ||||||||||||||||||
| /skins/default | 1 | ||||||||||||||||||
| /skins/default/css | 1 | ||||||||||||||||||
| /skins/default/css/admin | 1 | ||||||||||||||||||
| /skins/default/css/common | 1 | ||||||||||||||||||
| /skins/default/css/customer | 1 | ||||||||||||||||||
| /skins/default/plesk | 1 | ||||||||||||||||||
| /skins/default/plesk/css | 1 | ||||||||||||||||||
| /skins/default/plesk/css/left | 1 | ||||||||||||||||||
| /skins/default/plesk/css/main | 1 | ||||||||||||||||||
| /skins/default/plesk/css/top | 1 | ||||||||||||||||||
 | GHDB: Plesk login page | ||||||||||||||||||
| Affects | Variations | ||||||||||||||||||
| /login.php3 | 1 | ||||||||||||||||||
| Acunetix Website Audit | 9 | ||||||||||||||||||
| Alert details | |||||||||||||||||||
| SSL 2.0 deprecated protocol | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | High | ||||||||||||||||||
| Type | Configuration | ||||||||||||||||||
| Reported by module | Scripting (ssl_ping.script) | ||||||||||||||||||
| Description | |||||||||||||||||||
| The remote service encrypts traffic using an old deprecated protocol with known weaknesses. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| Disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| Server | |||||||||||||||||||
| Details | |||||||||||||||||||
| The SSL server (port: 443) encrypts traffic using an old deprecated protocol (SSL 2.0) with known weaknesses. | |||||||||||||||||||
| SSL weak ciphers | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Medium | ||||||||||||||||||
| Type | Configuration | ||||||||||||||||||
| Reported by module | Scripting (ssl_ping.script) | ||||||||||||||||||
| Description | |||||||||||||||||||
| The remote host supports the use of SSL ciphers that offer either weak encryption or no encryption at all. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| Reconfigure the affected application to avoid use of weak ciphers. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| Server | |||||||||||||||||||
| Details | |||||||||||||||||||
| Weak SSL ciphers (TLS1 on port 443): TLS1_CK_RSA_EXPORT_WITH_RC4_40_MD5 - Low strength TLS1_CK_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - Low strength TLS1_CK_RSA_EXPORT_WITH_DES40_CBC_SHA - Low strength TLS1_CK_RSA_WITH_DES_CBC_SHA - Low strength TLS1_CK_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA - Low strength TLS1_CK_DHE_RSA_WITH_DES_CBC_SHA - Low strength |
|||||||||||||||||||
| Acunetix Website Audit | 10 | ||||||||||||||||||
| Server | |||||||||||||||||||
| Details | |||||||||||||||||||
| Weak SSL ciphers (SSL3 on port 443): SSL3_CK_RSA_RC4_40_MD5 - Low strength SSL3_CK_RSA_RC2_40_MD5 - Low strength SSL3_CK_RSA_DES_40_CBC_SHA - Low strength SSL3_CK_RSA_DES_64_CBC_SHA - Low strength SSL3_CK_EDH_RSA_DES_40_CBC_SHA - Low strength SSL3_CK_EDH_RSA_DES_64_CBC_SHA - Low strength |
|||||||||||||||||||
| TLS1/SSLv3 Renegotiation Vulnerability | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Medium | ||||||||||||||||||
| Type | Configuration | ||||||||||||||||||
| Reported by module | TLS1_SSL3_Renegotiation | ||||||||||||||||||
| Description | |||||||||||||||||||
| A vulnerability in the way SSL and TLS protocols allow renegotiation requests may allow an attacker to inject plaintext into an application protocol stream. This could result in a situation where the attacker may be able to issue commands to the server that appear to be coming from a legitimate source. This issue affects SSL version 3.0 and newer and TLS version 1.0 and newer. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| A remote, unauthenticated attacker may be able to inject an arbitrary amount of chosen plaintext into the beginning of the application protocol stream. This could allow and attacker to issue HTTP requests, or take action impersonating the user, among other consequences. | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| Users should contact vendors for specific patch information. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| Web Server | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Login page password-guessing attack | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Low | ||||||||||||||||||
| Type | Validation | ||||||||||||||||||
| Reported by module | Scripting (Html_Authentication_Audit.script) | ||||||||||||||||||
| Description | |||||||||||||||||||
| A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. This login page doesn't have any protection against password-guessing attacks (brute force attacks). It's recommended to implement some type of account lockout after a defined number of incorrect password attempts. Consult Web references for more information about fixing this problem. |
|||||||||||||||||||
| Impact | |||||||||||||||||||
| An attacker may attempt to discover a weak password by systematically trying every possible combination of letters, numbers, and symbols until it discovers the one correct combination that works. | |||||||||||||||||||
| Acunetix Website Audit | 11 | ||||||||||||||||||
| Recommendation | |||||||||||||||||||
| It's recommended to implement some type of account lockout after a defined number of incorrect password attempts. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| /login_up.php3 | |||||||||||||||||||
| Details | |||||||||||||||||||
| The scanner tested 10 invalid credentials and no account lockout was detected. | |||||||||||||||||||
| Request | |||||||||||||||||||
| POST /login_up.php3 HTTP/1.1 Content-Length: 53 Content-Type: application/x-www-form-urlencoded Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* locale_id=default&login_name=cpJD667j&passwd=ZPGubZ7Z |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 200 OK Expires: Fri, 28 May 1999 00:00:00 GMT Last-Modified: Sat, 24 Sep 2011 14:28:10 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Content-Type: text/html; charset=utf-8 X-Plesk: PSA-Key/PLSK016479390000 Date: Sat, 24 Sep 2011 14:28:14 GMT Server: sw-cp-server Content-Length: 5607 |
|||||||||||||||||||
| Session Cookie without HttpOnly flag set | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Low | ||||||||||||||||||
| Type | Informational | ||||||||||||||||||
| Reported by module | Crawler | ||||||||||||||||||
| Description | |||||||||||||||||||
| This session cookie doesn't have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the cookie can only be accessed by the server and not by client-side scripts. This is an important security protection for session cookies. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| None | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| If possible, you should set the HTTPOnly flag for this cookie. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| / | |||||||||||||||||||
| Details | |||||||||||||||||||
| Cookie name: "PHPSESSID" Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6" |
|||||||||||||||||||
| Request | |||||||||||||||||||
| GET / HTTP/1.1 | |||||||||||||||||||
| Acunetix Website Audit | 12 | ||||||||||||||||||
| Pragma: no-cache Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 303 See Other Expires: Mon, 24 Oct 2011 14:25:10 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: max-age=2592000 Cache-Control: post-check=0, pre-check=0 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Pragma: no-cache Content-Type: text/html; charset=utf-8 Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/ Content-Length: 0 Date: Sat, 24 Sep 2011 14:25:11 GMT Server: sw-cp-server |
|||||||||||||||||||
| / | |||||||||||||||||||
| Details | |||||||||||||||||||
| Cookie name: "PHPSESSID" Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6" |
|||||||||||||||||||
| Request | |||||||||||||||||||
| GET / HTTP/1.1 Pragma: no-cache Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 303 See Other Expires: Mon, 24 Oct 2011 14:25:10 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: max-age=2592000 Cache-Control: post-check=0, pre-check=0 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Pragma: no-cache Content-Type: text/html; charset=utf-8 Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/ Content-Length: 0 Date: Sat, 24 Sep 2011 14:25:11 GMT Server: sw-cp-server |
|||||||||||||||||||
| Session Cookie without Secure flag set | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Low | ||||||||||||||||||
| Type | Informational | ||||||||||||||||||
| Reported by module | Crawler | ||||||||||||||||||
| Description | |||||||||||||||||||
| This session cookie doesn't have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session | |||||||||||||||||||
| Acunetix Website Audit | 13 | ||||||||||||||||||
| cookies. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| None | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| If possible, you should set the Secure flag for this cookie. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| / | |||||||||||||||||||
| Details | |||||||||||||||||||
| Cookie name: "PHPSESSID" Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6" |
|||||||||||||||||||
| Request | |||||||||||||||||||
| GET / HTTP/1.1 Pragma: no-cache Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 303 See Other Expires: Mon, 24 Oct 2011 14:25:10 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: max-age=2592000 Cache-Control: post-check=0, pre-check=0 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Pragma: no-cache Content-Type: text/html; charset=utf-8 Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/ Content-Length: 0 Date: Sat, 24 Sep 2011 14:25:11 GMT Server: sw-cp-server |
|||||||||||||||||||
| / | |||||||||||||||||||
| Details | |||||||||||||||||||
| Cookie name: "PHPSESSID" Cookie domain: "Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6" |
|||||||||||||||||||
| Request | |||||||||||||||||||
| GET / HTTP/1.1 Pragma: no-cache Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 303 See Other Expires: Mon, 24 Oct 2011 14:25:10 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: max-age=2592000 Cache-Control: post-check=0, pre-check=0 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT |
|||||||||||||||||||
| Acunetix Website Audit | 14 | ||||||||||||||||||
| P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Pragma: no-cache Content-Type: text/html; charset=utf-8 Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/smb/ Content-Length: 0 Date: Sat, 24 Sep 2011 14:25:11 GMT |
|||||||||||||||||||
| Broken links | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Informational | ||||||||||||||||||
| Type | Informational | ||||||||||||||||||
| Reported by module | Crawler | ||||||||||||||||||
| Description | |||||||||||||||||||
| A broken link refers to any link that should take you to a document, image or webpage, that actually results in an error. This page was linked from the website but it is inaccessible. | |||||||||||||||||||
| Impact | |||||||||||||||||||
| Problems navigating the site. | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| Remove the links to this file or make it accessible. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| /account | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /account HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:29 GMT Server: sw-cp-server |
|||||||||||||||||||
| /account/power-mode-logout | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /account/power-mode-logout HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| Acunetix Website Audit | 15 | ||||||||||||||||||
| HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:29 GMT Server: sw-cp-server |
|||||||||||||||||||
| /javascript | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /javascript/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/javascript/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /javascript/main.leie7.fixes.js | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /javascript/main.leie7.fixes.js HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /plesk | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /plesk HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Acunetix Website Audit | 16 | ||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:26 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/css | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/css/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive |
|||||||||||||||||||
| Acunetix Website Audit | 17 | ||||||||||||||||||
| Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/css/admin | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/css/admin/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/admin/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:34 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:34 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/css/common | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/css/common/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/common/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/css/customer | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/css/customer/ HTTP/1.1 | |||||||||||||||||||
| Acunetix Website Audit | 18 | ||||||||||||||||||
| Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/css/customer/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/plesk | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/plesk/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:17 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:17 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/plesk/css | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/plesk/css/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:34 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:34 GMT Server: sw-cp-server |
|||||||||||||||||||
| Acunetix Website Audit | 19 | ||||||||||||||||||
| /skins/default/plesk/css/left | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/plesk/css/left/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/left/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:34 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:34 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/plesk/css/main | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/plesk/css/main/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/main/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:34 GMT Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:34 GMT Server: sw-cp-server |
|||||||||||||||||||
| /skins/default/plesk/css/top | |||||||||||||||||||
| Details | |||||||||||||||||||
| No details are available. | |||||||||||||||||||
| Request | |||||||||||||||||||
| GET /skins/default/plesk/css/top/ HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/skins/default/plesk/css/top/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 404 Not Found Expires: Mon, 24 Oct 2011 14:25:34 GMT |
|||||||||||||||||||
| Acunetix Website Audit | 20 | ||||||||||||||||||
| Cache-Control: max-age=2592000 Content-Type: text/html Content-Length: 345 Date: Sat, 24 Sep 2011 14:25:34 GMT |
|||||||||||||||||||
| GHDB: Plesk login page | |||||||||||||||||||
 |
|||||||||||||||||||
| Severity | Informational | ||||||||||||||||||
| Type | Informational | ||||||||||||||||||
| Reported by module | GHDB | ||||||||||||||||||
| Description | |||||||||||||||||||
The description for this alert is contributed by the GHDB community, it may contain inappropriate language. Category : Advisories and Vulnerabilities Plesk is a multi platform control panel solution for hosting. More information: hxxp://www.swsoft.com/plesk/ Vulnerability: PLESK 7.5 Reload (and lower) & PLESK 7.6 for M$ Windows path passing and disclosure] Discovered By: GuanYu The Google Hacking Database (GHDB) appears courtesy of the Google Hacking community. |
|||||||||||||||||||
| Impact | |||||||||||||||||||
| Not available. Check description. | |||||||||||||||||||
| Recommendation | |||||||||||||||||||
| Not available. Check description. | |||||||||||||||||||
| Affected items | |||||||||||||||||||
| /login.php3 | |||||||||||||||||||
| Details | |||||||||||||||||||
| We found inurl:+:8443/login.php3 |
|||||||||||||||||||
| Request | |||||||||||||||||||
| GET /login.php3 HTTP/1.1 Pragma: no-cache Referer: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/ Cookie: PHPSESSID=2164ae932854bc55b185e0e22ab867d3; locale=en-US Host: Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Accept: */* |
|||||||||||||||||||
| Response | |||||||||||||||||||
| HTTP/1.1 303 See Other Last-Modified: Sat, 24 Sep 2011 14:25:11 GMT Cache-Control: post-check=0, pre-check=0 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 P3P: CP="NON COR CURa ADMa OUR NOR UNI COM NAV STA" Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Content-Type: text/html; charset=utf-8 Location: https://Plesk Parallels Panel Version psa v10.2.0_build1011110331.18 os_RedHat el6:8443/login.php3 Content-Length: 0 Date: Sat, 24 Sep 2011 14:25:11 GMT Server: sw-cp-server |
|||||||||||||||||||
| Acunetix Website Audit | 21 | ||||||||||||||||||