349 matches found
CVE-2014-2353 Cogent DataHub XSS
Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2014-2352 Cogent DataHub Path Traversal
The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause the web server...
CVE-2014-2354
CVE-2014-2354 affects Cogent DataHub before 7.3.5, where usernames/passwords are stored unsalted, making brute-force attacks easier to recover cleartext passwords. The vulnerability is not remotely exploitable for the password-hash issue, though other issues in the advisory may be. Cogent release...
CVE-2014-2353
Cogent DataHub before 7.3.5 is affected by a reflected cross-site scripting (XSS) vulnerability (CVE-2014-2353) due to inadequate input sanitization. The CVE entry documents that an attacker can inject arbitrary HTML/script via unspecified vectors, potentially affecting users’ browser sessions. T...
CVE-2014-3789
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...
Heap overflow
Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request...
Command injection
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...
CVE-2014-3789
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...
CVE-2014-3788
The CVE affects Cogent DataHub’s Web Server, vulnerable to a heap-based buffer overflow when processing a crafted Content-Length value in a request. The issue exists in Cogent Real-Time Systems’ Cogent DataHub before version 7.3.5, enabling remote code execution. Public sources (ZDI advisory ZDI-...
CVE-2014-3788
Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request...
CVE-2014-3789
CVE-2014-3789 affects Cogent Real-Time Systems’ Cogent DataHub web server. The vulnerability lies in GetPermissions.asp, where insecure use of the datahub_command function with user-supplied input enables remote command execution. Public sources indicate this could be exploited remotely and led t...
Cogent DataHub Heap Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the included Web Server. By providing a request with a crafted Content-Length field, an...
Cogent DataHub Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetPermissions.asp component of the web server. This active server page is vulnerab...
Cogent DataHub Command Injection
This module exploits an injection vulnerability in Cogent DataHub prior to 7.3.5. The vulnerability exists in the GetPermissions.asp page, which makes insecure use of the datahubcommand function with user controlled data, allowing execution of arbitrary datahub commands and scripts. This module h...
Cogent DataHub Code Injection Vulnerability
OVERVIEW NCCIC/ICS-CERT has become aware of a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. hereafter referred to as Cogent. Security researcher John Leitch reported this vulnerability to the Zero Day Initiative ZDI, who then...
Cogent DataHub Vulnerabilities
OVERVIEW Independent researcher Alain Homewood has identified four vulnerabilities in the Cogent Real-Time Systems DataHub application. Cogent Real-Time Systems has produced a new version that mitigates three of the four identified vulnerabilities; they have recommended a mitigation for the...
Cogent DataHub < 7.3.4 Malformed POST Request Buffer Overflow RCE
Binary data scadacogentdatahub734.nbin...
Cogent DataHub Heap Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of POST requests. By sending a malformed POST, an attacker is able to...