CVE-2014-2353

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2354

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Design/Logic Flaw

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

Directory traversal

Directory traversal vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to read arbitrary files of unspecified types, or cause a web-server denial of service, via a crafted pathname...

Cross site scripting

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2352

CVE-2014-2352 describes a directory traversal in Cogent DataHub prior to version 7.3.5, where the directory specifier can traverse paths to access limited hard-coded file types and potentially cause a web server DoS. Affected product: Cogent DataHub (pre-7.3.5). Root cause: improper path traversa...

CVE-2014-2354 Cogent DataHub Use of Password Hash With Insufficient Computational Effort

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack...

CVE-2014-2353 Cogent DataHub XSS

Cross-site scripting XSS vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2353

Cogent DataHub before 7.3.5 is affected by a reflected cross-site scripting (XSS) vulnerability (CVE-2014-2353) due to inadequate input sanitization. The CVE entry documents that an attacker can inject arbitrary HTML/script via unspecified vectors, potentially affecting users’ browser sessions. T...

CVE-2014-2354

CVE-2014-2354 affects Cogent DataHub before 7.3.5, where usernames/passwords are stored unsalted, making brute-force attacks easier to recover cleartext passwords. The vulnerability is not remotely exploitable for the password-hash issue, though other issues in the advisory may be. Cogent release...

CVE-2014-2352 Cogent DataHub Path Traversal

The directory specifier can include designators that can be used to traverse the directory path. Exploiting this vulnerability may enable an attacker to access a limited number of hardcoded file types. Further exploitation of this vulnerability may allow an attacker to cause the web server...

CVE-2014-3789

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...

Heap overflow

Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request...

Command injection

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-3788

The CVE affects Cogent DataHub’s Web Server, vulnerable to a heap-based buffer overflow when processing a crafted Content-Length value in a request. The issue exists in Cogent Real-Time Systems’ Cogent DataHub before version 7.3.5, enabling remote code execution. Public sources (ZDI advisory ZDI-...

CVE-2014-3789

GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-3788

Heap-based buffer overflow in the Web Server in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary code via a negative value in the Content-Length field in a request...

CVE-2014-3789

CVE-2014-3789 affects Cogent Real-Time Systems’ Cogent DataHub web server. The vulnerability lies in GetPermissions.asp, where insecure use of the datahub_command function with user-supplied input enables remote command execution. Public sources indicate this could be exploited remotely and led t...

Cogent DataHub Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetPermissions.asp component of the web server. This active server page is vulnerab...

Cogent DataHub Heap Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the included Web Server. By providing a request with a crafted Content-Length field, an...