Design/Logic Flaw

The drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkgdirectory parameter in a doinstall action to dtc/...

CVE-2011-3195

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

CVE-2011-5273

Directory traversal vulnerability in shared/package-installer in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. dot dot in the pkg parameter in a doinstall action to dtc/...

Code injection

shared/inc/sql/lists.php in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options...

Sql injection

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domaininfo.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272...

CVE-2011-3199

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

CVE-2011-3196

The setup script in Domain Technologie Control DTC before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

CVE-2011-5276

SQL injection vulnerability in the drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the databasename parameter...

CVE-2011-3198

DTV/CVE-2011-3198 affects Domain Technologie Control (DTC) prior to version 0.34.1. The vulnerability arises from DTC passing a password via the -b option to htpasswd, which could allow a local attacker to read thepassword by inspecting the running process or /proc arguments. Documents from NVD a...

CVE-2011-5276

CVE-2011-5276 is a SQL injection vulnerability in Domain Technologie Control (DTC) prior to 0.32.11. The flaw occurs in the drawAdminTools_PackageInstaller function, within shared/inc/forms/packager.php, where the database_name parameter can be exploited by remote authenticated users to execute a...

CVE-2011-5274

The CVE-2011-5274 issue affects Domain Technologie Control (DTC) before version 0.32.11, where the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter during a do...

CVE-2011-5273

CVE-2011-5273 : Domain Technologie Control (DTC) before 0.34.1 has a directory traversal flaw in the shared/package-installer component. An authenticated remote user can craft a problematic pkg parameter in a do_install action to dtc/ to trigger arbitrary PHP code execution. Root cause is imprope...

CVE-2011-3197

Summary: CVE-2011-3197 refers to an SQL injection in Domain Technologies Control (DTC) before version 0.34.1. The vulnerability can be triggered by unsafely handling user-provided parameters in web forms. The original CVE-2011-3197 has been split; CVE-2011-5272 covers the vps_note parameter path ...

CVE-2011-3196

The CVE-2011-3196 issue affects Domain Technologie Control (DTC) prior to version 0.34.1. The root cause is world-readable permissions on /etc/apache2/apache2.conf, which allowed local users to read a configuration file and obtain the dtcdaemons MySQL password. Impact was local, with confidential...

CVE-2011-3195

CVE-2011-3195 affects Domain Technologie Control (DTC) prior to 0.34.1. The vulnerability is in shared/inc/sql/lists.php where remote authenticated users can execute shell commands via metacharacters in mailing list tunable options, enabling command execution with the potential for partial impact...

CVE-2011-3199

CVE-2011-3199 affects Domain Technologie Control (DTC) prior to version 0.34.1. The vulnerability is a set of cross-site scripting (XSS) flaws allowing remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or (2) DNS and (3) MX form, demons...

CVE-2011-5272

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vpsnote parameter to dtcadmin/logPushlet.php. NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different...

CVE-2011-5276

SQL injection vulnerability in the drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the databasename parameter...

CVE-2011-3198

Domain Technologie Control DTC before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments...