Aziz Knani

**Name of the Vulnerable Software and Affected Versions** Plesk for Linux versions 18.0.34 through 18.0.79.8 **Description** A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to elevate their privileges to the root account on the hosting server. **Recommendations** Update to version 18.0.79.9 or 18.0.80.5.

**Name of the Vulnerable Software and Affected Versions** Plesk versions 18.0.79.7 and earlier Plesk versions 18.0.80 through 18.0.80.3 **Description** An insecure direct object reference allows remote authenticated users to read and modify databases belonging to other customers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plesk (affected versions not specified) **Description** Improper neutralization of special elements allows remote authenticated users to disclose arbitrary local files and escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.