CVE-2014-2353

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2354

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Design/Logic Flaw

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Cross site scripting

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Directory traversal

Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname...

CVE-2014-2352 Cogent DataHub Path Traversal

The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause the web server...

CVE-2014-2353 Cogent DataHub XSS

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2354 Cogent DataHub Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2352

CVE-2014-2352 describes a directory traversal in Cogent DataHub prior to version 7.3.5, where the directory specifier can traverse paths to access limited hard-coded file types and potentially cause a web server DoS. Affected product: Cogent DataHub (pre-7.3.5). Root cause: improper path traversa...

CVE-2014-2353

Cogent DataHub before 7.3.5 is affected by a reflected cross-site scripting (XSS) vulnerability (CVE-2014-2353) due to inadequate input sanitization. The CVE entry documents that an attacker can inject arbitrary HTML/script via unspecified vectors, potentially affecting users’ browser sessions. T...

CVE-2014-2354

CVE-2014-2354 affects Cogent DataHub before 7.3.5, where usernames/passwords are stored unsalted, making brute-force attacks easier to recover cleartext passwords. The vulnerability is not remotely exploitable for the password-hash issue, though other issues in the advisory may be. Cogent release...

CVE-2014-2353: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4643

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions prior to 7.3.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 7.3.5, update to version 7.3.5 or later to resolve the...

PT-2014-4644

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions prior to 7.3.5 Description The issue makes it easier for attackers to obtain cleartext passwords via a brute-force attack because it does not use a salt during password hashing. Recommendations For versions prior to...

PT-2014-4642

Name of the Vulnerable Software and Affected Versions Cogent DataHub versions prior to 7.3.5 Description A directory traversal issue allows remote attackers to read arbitrary files or cause a web-server denial of service via a crafted pathname. Recommendations For versions prior to 7.3.5, update ...

CVE-2014-2354: Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-3789

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...

Heap overflow

Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request...

Command injection

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-3789

CVE-2014-3789 affects Cogent Real-Time Systems’ Cogent DataHub web server. The vulnerability lies in GetPermissions.asp, where insecure use of the datahub_command function with user-supplied input enables remote command execution. Public sources indicate this could be exploited remotely and led t...