FreeBSD Ports: dtc

The remote host is missing an update to the system as announced in the referenced advisory. VID 879b0242-c5b6-11e0-abd1-0017f22d6707 OpenVAS Vulnerability Test $ Description: Auto generated from VID 879b0242-c5b6-11e0-abd1-0017f22d6707 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

FreeBSD Ports: dtc

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : dtc -- multiple vulnerabilities (879b0242-c5b6-11e0-abd1-0017f22d6707)

Ansgar Burchardt reports : Ansgar Burchardt discovered several vulnerabilities in DTC, a web control panel for admin and accounting hosting services : The bwpermoth.php graph contains a SQL injection vulnerability; insufficient checks in bwpermonth.php can lead to bandwidth usage information...

Debian Security Advisory DSA 2179-1 (dtc)

The remote host is missing an update to dtc announced via advisory DSA 2179-1. OpenVAS Vulnerability Test $Id: deb21791.nasl 6613 2017-07-07 12:08:40Z cfischer $ Description: Auto-generated from advisory DSA 2179-1 dtc Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

Debian: Security Advisory (DSA-2179-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-0435

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0437

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

Design/Logic Flaw

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

Sql injection

Multiple SQL injection vulnerabilities in Domain Technologie Control DTC before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 admin/bwpermonth.php or 2 client/bwpermonth.php...

CVE-2011-0435

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0437

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2011-0435

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0435

DTC (Domain Technologie Control) prior to 0.32.9 is vulnerable via bw_per_month.php (admin and client) allowing unauthenticated remote access to bandwidth usage data due to insufficient access checks. Impact: partial confidentiality disclosure. A fix is available in version 0.32.9 or newer; updat...

CVE-2011-0436

CVE-2011-0436 affects Domain Technologie Control (DTC) prior to 0.32.9. The register_user flow in client/new_account_form.php sends the new account password in plaintext via email, enabling password exposure if network traffic is sniffed. Public sources (NVD/OpenVAS/DSA references) confirm this i...

CVE-2011-0434

CVE-2011-0434 concerns Domain Technologie Control (DTC) prior to 0.32.9. The vulnerability is a SQL injection in the cid parameter of bw_per_month.php endpoints (admin and client paths), enabling remote attackers to inject arbitrary SQL via the affected web interface. Public sources also note rel...

CVE-2011-0434: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Domain Technologie Control DTC before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 admin/bwpermonth.php or 2 client/bwpermonth.php...

CVE-2011-0437: Undefined Security Weakness

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2011-0435: Improper Authentication

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0436: Undefined Security Weakness

The registeruser function in client/newaccountform.php in Domain Technologie Control DTC before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

Debian DSA-2179-1 : dtc - SQL injection

Ansgar Burchardt discovered several vulnerabilities in DTC, a web control panel for admin and accounting hosting services. - CVE-2011-0434 The bwpermoth.php graph contains a SQL injection vulnerability. - CVE-2011-0435 Insufficient checks in bwpermonth.php can lead to bandwidth usage information...