Gplhost

Domain Technologie Control

15 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2011-5274

  • EPSS 0.8%
  • Veröffentlicht 21.03.2014 04:38:58
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_...

7.5

CVE-2011-5275

  • EPSS 0.25%
  • Veröffentlicht 21.03.2014 04:38:58
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges.

6.5

CVE-2011-5276

  • EPSS 0.34%
  • Veröffentlicht 21.03.2014 04:38:58
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the database_name ...

2.1

CVE-2011-3196

  • EPSS 0.05%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.

6.5

CVE-2011-3197

  • EPSS 0.6%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE-2011-3197 has been SPLIT due ...

2.1

CVE-2011-3198

  • EPSS 0.07%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.

3.5

CVE-2011-3199

  • EPSS 0.23%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (...

6.5

CVE-2011-5272

  • EPSS 0.39%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php. NOTE: this issue was originally part of CVE-2011...

6.5

CVE-2011-5273

  • EPSS 0.71%
  • Veröffentlicht 21.03.2014 04:38:53
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a do_install action to dtc/.

6.5

CVE-2011-3195

  • EPSS 0.71%
  • Veröffentlicht 21.03.2014 04:38:51
  • Zuletzt bearbeitet 12.04.2025 10:46:40

shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.