Code injection

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

CVE-2011-5273

Directory traversal vulnerability in shared/package-installer in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. dot dot in the pkg parameter in a doinstall action to dtc/...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

CVE-2011-3199

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

CVE-2011-5276

SQL injection vulnerability in the drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the databasename parameter...

Design/Logic Flaw

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

Sql injection

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domaininfo.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272...

CVE-2011-3196

The setup script in Domain Technologie Control DTC before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file...

CVE-2011-5274

The CVE-2011-5274 issue affects Domain Technologie Control (DTC) before version 0.32.11, where the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter during a do...

CVE-2011-3196

The CVE-2011-3196 issue affects Domain Technologie Control (DTC) prior to version 0.34.1. The root cause is world-readable permissions on /etc/apache2/apache2.conf, which allowed local users to read a configuration file and obtain the dtcdaemons MySQL password. Impact was local, with confidential...

CVE-2011-5276

SQL injection vulnerability in the drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the databasename parameter...

CVE-2011-3198

DTV/CVE-2011-3198 affects Domain Technologie Control (DTC) prior to version 0.34.1. The vulnerability arises from DTC passing a password via the -b option to htpasswd, which could allow a local attacker to read thepassword by inspecting the running process or /proc arguments. Documents from NVD a...

CVE-2011-5275

The install script in Domain Technologie Control DTC before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges...

CVE-2011-3199

CVE-2011-3199 affects Domain Technologie Control (DTC) prior to version 0.34.1. The vulnerability is a set of cross-site scripting (XSS) flaws allowing remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or (2) DNS and (3) MX form, demons...

CVE-2011-5272

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vpsnote parameter to dtcadmin/logPushlet.php. NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different...

CVE-2011-5272

Affected product: Domain Technologie Control (DTC) prior to 0.34.1. Vulnerability: SQL injection via the vps_note parameter to dtcadmin/logPushlet.php, allowing remote authenticated users to execute arbitrary SQL commands. Root cause (as stated): input handling leads to SQL injection; CVE-2011-52...

CVE-2011-3198

Domain Technologie Control DTC before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments...

CVE-2011-5275

The CVE affects Domain Technologie Control (DTC) installations where the install script before version 0.34.1 erroneously grants sudo permissions for chrootuid to the dtc user, enabling potential privilege escalation. Root cause: the installer script configures sudo access for dtc, increasing the...

CVE-2011-3195

CVE-2011-3195 affects Domain Technologie Control (DTC) prior to 0.34.1. The vulnerability is in shared/inc/sql/lists.php where remote authenticated users can execute shell commands via metacharacters in mailing list tunable options, enabling command execution with the potential for partial impact...