rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-2284 
The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-24T14:00:00.000Z
CVE-2014-2285 
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T22:00:00.000Z
CVE-2014-2286 
main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2014-2287 
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2014-2288 
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2014-2289 
res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T19:00:00.000Z
CVE-2014-2291 
Cross-site scripting (XSS) vulnerability in the Pulse Collaboration (Secure Meeting) user pages in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2014-2292 
Unspecified vulnerability in the Linux Network Connect client in Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS before 7.1r18, 7.3 before 7.3r10, 7.4 before 7.4r8, and 8.0 before 8.0r1 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2014-2293 
Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the (1) authentication_method_ser or (2) authentication_info_ser parameter to index.php, or (3) zikulaMobileTheme parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-26T18:00:00.000Z
CVE-2014-2294 
Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-17T19:00:00.000Z
CVE-2014-2296 
XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-20T17:00:00.000Z
CVE-2014-2297 
Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to ls/htmlchat.php or (2) bgcolor parameter to ls/index.php.  NOTE: vector 1 may overlap CVE-2014-1906.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-19T21:00:00.000Z
CVE-2014-2299 
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T01:00:00.000Z
CVE-2014-2301 
OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive metadata via the inf operations (op=inf) to an object in pub/bscw.cgi/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-2302 
The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-19T17:00:00.000Z
CVE-2014-2303 
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2014-2304 
A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of the controller service. This effect is the result of a flaw in OpenFlow protocol processing, where specific malformed and mistimed FEATURES_REPLY messages cause the controller service to not delete switch and port data from its internal tracking structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T17:01:41.000Z
CVE-2014-2309 
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T01:00:00.000Z
CVE-2014-2310 
The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-17T14:00:00.000Z
CVE-2014-2311 
SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T15:00:00.000Z
CVE-2014-2312 
The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-26T18:00:00.000Z
CVE-2014-2313 
Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2014-2314 
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2014-2315 
Multiple cross-site scripting (XSS) vulnerabilities in the Thank You Counter Button plugin 1.8.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) thanks_caption, (2) thanks_caption_style, or (3) thanks_style parameter to wp-admin/options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2014-2316 
SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2014-2317 
SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the table parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-07T20:00:00.000Z
CVE-2014-2318 
SQL injection vulnerability in ATCOM Netvolution 3 allows remote attackers to execute arbitrary SQL commands via the m parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-10T14:00:00.000Z
CVE-2014-2319 
The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T10:00:00.000Z
CVE-2014-2321 
web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-11T10:00:00.000Z
CVE-2014-2322 
lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T14:00:00.000Z
CVE-2014-2323 
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2014-2324 
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T15:00:00.000Z
CVE-2014-2325 
Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-14T14:00:00.000Z
CVE-2014-2326 
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web  script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-27T16:00:00.000Z
CVE-2014-2327 
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T14:00:00.000Z
CVE-2014-2328 
lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-23T14:00:00.000Z
CVE-2014-2329 
Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not properly handled by the logwatch module, or other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2014-2330 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2014-2331 
Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot.  NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2014-2332 
Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2014-2333 
Cross-site scripting (XSS) vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-11T14:00:00.000Z
CVE-2014-2334 
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T14:00:00.000Z
CVE-2014-2335 
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T14:00:00.000Z
CVE-2014-2336 
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-31T14:00:00.000Z
CVE-2014-2338 
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2014-2339 
Multiple SQL injection vulnerabilities in bbs/ajax.autosave.php in GNUboard 5.x and possibly earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) subject or (2) content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-19T14:00:00.000Z
CVE-2014-2340 
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-03T15:00:00.000Z
CVE-2014-2341 
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-21T14:00:00.000Z
CVE-2014-2342 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Triangle MicroWorks
product: SCADA Data Gateway
default_status: unaffected
Credits: lang: en
value: Adam Crain of Automatak and Chris Sistrunk of Mandiant
Published: 2014-05-30T23:00:00.000Z
CVE-2014-2343 Triangle MicroWorks SCADA Data Gateway Resource Exhaustion
Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows physically proximate attackers to cause a denial of service (excessive data processing) via a crafted DNP request over a serial line.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Triangle MicroWorks
product: SCADA Data Gateway
default_status: unaffected
Credits: lang: en
value: Adam Crain of Automatak and Chris Sistrunk of Mandiant
Published: 2014-05-30T23:00:00.000Z
CVE-2014-2345 COPA-DATA zenon DNP3 Improper Input Validation
COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow remote attackers to cause a denial of service (infinite loop and process crash) by sending a crafted DNP3 packet over TCP.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: COPA-DATA
product: zenon DNP3 NG driver (DNP3 master)
default_status: unaffected
vendor: COPA-DATA
product: zenon DNP3 Process Gateway (DNP3 outstation)
default_status: unaffected
Credits: lang: en
value: Automation software company Ing. Punzenberger COPA-DATA GmbH
Published: 2014-06-05T17:00:00.000Z
CVE-2014-2346 COPA-DATA zenon DNP3 Improper Input Validation
COPA-DATA zenon DNP3 NG driver (DNP3 master) 7.10 and 7.11 through 7.11 SP0 build 10238 and zenon DNP3 Process Gateway (DNP3 outstation) 7.11 SP0 build 10238 and earlier allow physically proximate attackers to cause a denial of service (infinite loop and process crash) via crafted input over a serial line.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: COPA-DATA
product: zenon DNP3 NG driver (DNP3 master)
default_status: unaffected
vendor: COPA-DATA
product: zenon DNP3 Process Gateway (DNP3 outstation)
default_status: unaffected
Credits: lang: en
value: Automation software company Ing. Punzenberger COPA-DATA GmbH
Published: 2014-06-05T17:00:00.000Z
CVE-2014-2347 AMTELCO miSecure Information Exposure
Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: AMTELCO
product: miSecureMessages
default_status: unaffected
Credits: lang: en
value: Jared Bird of Allina Health
Published: 2014-05-06T10:00:00.000Z
CVE-2014-2349 Emerson DeltaV Use of Improper Authorization
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Emerson
product: DeltaV
default_status: unaffected
Credits: lang: en
value: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov of Positive Technologies
Published: 2014-05-22T20:00:00.000Z
CVE-2014-2350 Emerson DeltaV Use of Hard-coded Credentials
Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restrictions via a TCP session, as demonstrated by a session that uses the telnet program.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Emerson
product: DeltaV
default_status: unaffected
Credits: lang: en
value: Kirill Nesterov, Alexander Tlyapov, Dmitry Nagibin, Alexey Osipov, and Timur Yunusov of Positive Technologies
Published: 2014-05-22T20:00:00.000Z
CVE-2014-2351 CSWorks SQL Injection
SQL injection vulnerability in the LiveData service in CSWorks before 2.5.5233.0 allows remote attackers to execute arbitrary SQL commands via vectors related to pathnames contained in web API requests.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: CSWorks
product: CSWorks
default_status: unaffected
Credits: lang: en
value: John Leitch, working with HP’s Zero Day Initiative (ZDI)
Published: 2014-05-20T10:00:00.000Z
CVE-2014-2352 Cogent DataHub Path Traversal
The directory specifier can include designators that can be used to 
traverse the directory path. Exploiting this vulnerability may enable an
 attacker to access a limited number of hardcoded file types. Further 
exploitation of this vulnerability may allow an attacker to cause the 
web server component to enter a denial-of-service condition.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: Cogent
product: DataHub
default_status: unaffected
Credits: lang: en
value: Alain Homewood
Published: 2014-05-30T23:00:00.000Z
CVE-2014-2353 Cogent DataHub XSS
Cross-site scripting (XSS) vulnerability in Cogent DataHub before 7.3.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: cwe_id: CWE-80
description: CWE-80
Affected products: vendor: Cogent
product: DataHub
default_status: unaffected
Credits: lang: en
value: Alain Homewood
Published: 2014-05-30T23:00:00.000Z
CVE-2014-2354 Cogent DataHub Use of Password Hash With Insufficient Computational Effort
Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
Problem types: cwe_id: CWE-916
description: CWE-916
Affected products: vendor: Cogent
product: DataHub
default_status: unaffected
Credits: lang: en
value: Alain Homewood
Published: 2014-05-30T23:00:00.000Z