Domain Technologie Control

domain_technologie_control

Vendor: Gplhost • 15 CVEs

CVEs (15)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-5276 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL c...Show more SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the database_name parameter.Show less
CVE-2011-5275 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges.
CVE-2011-5274 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 7.5 HIGH· v2 The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpk...Show more The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.Show less
CVE-2011-5273 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a...Show more Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a do_install action to dtc/.Show less
CVE-2011-5272 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php. NOTE: this issue w...Show more SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php. NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different researchers.Show less
CVE-2011-3199 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket o...Show more Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form, as demonstrated by the "Domain root TXT record:" field.Show less
CVE-2011-3198 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.
CVE-2011-3197 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE...Show more SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps_note parameter to dtcadmin/logPushlet.php vector.Show less
CVE-2011-3196 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 2.1 LOW· v2 The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.
CVE-2011-3195 1Gplhost 1Domain Technologie Control May 6, 2026 Mar 21, 2014 N/A· v4 N/A· v3 6.5 MEDIUM· v2 shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.
CVE-2011-0437 1Gplhost 1Domain Technologie Control Apr 29, 2026 Mar 7, 2011 N/A· v4 N/A· v3 4.0 MEDIUM· v2 shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control (DTC) before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edssh_account parameter in a d...Show more shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control (DTC) before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edssh_account parameter in a deletesshaccount Delete action.Show less
CVE-2011-0436 1Gplhost 1Domain Technologie Control Apr 29, 2026 Mar 7, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensiti...Show more The register_user function in client/new_account_form.php in Domain Technologie Control (DTC) before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.Show less
CVE-2011-0435 1Gplhost 1Domain Technologie Control Apr 29, 2026 Mar 7, 2011 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Domain Technologie Control (DTC) before 0.32.9 does not require authentication for (1) admin/bw_per_month.php and (2) client/bw_per_month.php, which allows remote attackers to obtain potentially sensitive bandwidth infor...Show more Domain Technologie Control (DTC) before 0.32.9 does not require authentication for (1) admin/bw_per_month.php and (2) client/bw_per_month.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request.Show less
CVE-2011-0434 1Gplhost 1Domain Technologie Control Apr 29, 2026 Mar 7, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_m...Show more Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_month.php.Show less
CVE-2009-0402 1Gplhost 1Domain Technologie Control Apr 23, 2026 Feb 3, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name,...Show more SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.Show less