CVE-2011-0435: Improper Authentication

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0434: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Domain Technologie Control DTC before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 admin/bwpermonth.php or 2 client/bwpermonth.php...