deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-0834
Published: 2023-04-28
Description: Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue affects Workforce Access: from 6.12 before 8.1.


CVSS Score: 7.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.hypr.com/security-advisories; https://www.hypr.com/security-advisories
CVE: CVE-2023-1477
Published: 2023-04-28
Description: Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3.


CVSS Score: 7.2 (HIGH)
CWE: CWE-287, CWE-287
References: https://www.hypr.com/security-advisories; https://www.hypr.com/security-advisories
CVE: CVE-2023-29815
Published: 2023-04-28
Description: mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/chshcms/mccms/issues/3; https://github.com/chshcms/mccms/issues/3
CVE: CVE-2023-2374
Published: 2023-04-28
Description: A vulnerability has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6 and classified as critical. This vulnerability affects unknown code of the component Web Management Interface. The manipulation of the argument ecn-down leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227650 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/6; https://vuldb.com/?ctiid.227650; https://vuldb.com/?id.227650
CVE: CVE-2023-2375
Published: 2023-04-28
Description: A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6 and classified as critical. This issue affects some unknown processing of the component Web Management Interface. The manipulation of the argument src leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227651.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/7; https://vuldb.com/?ctiid.227651; https://vuldb.com/?id.227651
CVE: CVE-2022-31643
Published: 2023-04-28
Description: A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.
CVSS Score: 5.5 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]209-16/hpsbhf03812; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]209-16/hpsbhf03812
CVE: CVE-2023-27971
Published: 2023-04-28
Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]003-16/hpsbpi03839; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]003-16/hpsbpi03839
CVE: CVE-2023-27972
Published: 2023-04-28
Description: Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]104-16/hpsbpi03840; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]104-16/hpsbpi03840
CVE: CVE-2023-2376
Published: 2023-04-28
Description: A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been classified as critical. Affected is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227652.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/8; https://vuldb.com/?ctiid.227652; https://vuldb.com/?id.227652
CVE: CVE-2023-2377
Published: 2023-04-28
Description: A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Web Management Interface. The manipulation of the argument name leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227653 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/9; https://vuldb.com/?ctiid.227653; https://vuldb.com/?id.227653
CVE: CVE-2023-2378
Published: 2023-04-28
Description: A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument suffix-rate-up leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227654 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/CI/4; https://vuldb.com/?ctiid.227654; https://vuldb.com/?id.227654
CVE: CVE-2023-30854
Published: 2023-04-28
Description: AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/WWBN/AVideo/security/advisories/GHSA-6vrj-ph27-qfp3; https://github.com/WWBN/AVideo/security/advisories/GHSA-6vrj-ph27-qfp3
CVE: CVE-2023-30856
Published: 2023-04-28
Description: eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.
CVSS Score: 8.3 (HIGH)
CWE: CWE-346, CWE-1385, CWE-346
References: https://christian-schneider.net/CrossSiteWebSocketHijacking.html; https://github.com/GitSquared/edex-ui/blob/04a00c[PII_REDACTED]b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458; https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
CVE: CVE-2023-1526
Published: 2023-04-28
Description: Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physically removed from the printer.
CVSS Score: 4.6 (MEDIUM)
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]691-16/hpsbpi03837; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]691-16/hpsbpi03837
CVE: CVE-2023-27973
Published: 2023-04-28
Description: Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://support.hp.com/us-en/document/ish_7[PII_REDACTED]161-16/hpsbpi03841; https://support.hp.com/us-en/document/ish_7[PII_REDACTED]161-16/hpsbpi03841
CVE: CVE-2023-2379
Published: 2023-04-28
Description: A vulnerability classified as critical has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown part of the component Web Service. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227655.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-404
References: https://github.com/leetsun/IoT/tree/main/EdgeRouterX/DoS; https://vuldb.com/?ctiid.227655; https://vuldb.com/?id.227655
CVE: CVE-2023-2380
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227658 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/17; https://vuldb.com/?ctiid.227658; https://vuldb.com/?id.227658
CVE: CVE-2023-2381
Published: 2023-04-28
Description: A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/6; https://vuldb.com/?ctiid.227659; https://vuldb.com/?id.227659
CVE: CVE-2023-2382
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument sysLogInfo.serverName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227660. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/1; https://vuldb.com/?ctiid.227660; https://vuldb.com/?id.227660
CVE: CVE-2023-25930
Published: 2023-04-28
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service.  Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally.  IBM X-Force ID:  247862.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247862; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6985677
CVE: CVE-2023-27555
Published: 2023-04-28
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 is vulnerable to a denial of service when attempting to use ACR client affinity for unfenced DRDA federation wrappers.  IBM X-Force ID:  249187.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249187; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6985683
CVE: CVE-2023-27864
Published: 2023-04-28
Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.  IBM X-Force ID:  249327.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249327; https://www.ibm.com/support/pages/node/6983460; https://exchange.xforce.ibmcloud.com/vulnerabilities/249327
CVE: CVE-2023-29334
Published: 2023-04-28
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29334; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29334; https://security.gentoo.org/glsa/202309-17
CVE: CVE-2023-2383
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227661 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/2; https://vuldb.com/?ctiid.227661; https://vuldb.com/?id.227661
CVE: CVE-2023-2384
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. This vulnerability affects unknown code of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument dhcp.SecDnsIPByte2 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227662 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/3; https://vuldb.com/?ctiid.227662; https://vuldb.com/?id.227662
CVE: CVE-2023-2385
Published: 2023-04-28
Description: A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. This issue affects some unknown processing of the file scgi-bin/platform.cgi?page=ike_policies.htm of the component Web Management Interface. The manipulation of the argument IpsecIKEPolicy.IKEPolicyName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227663. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/5; https://vuldb.com/?ctiid.227663; https://vuldb.com/?id.227663
CVE: CVE-2023-30455
Published: 2023-04-28
Description: An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-separated e-statement IDs without throwing an error. When this many IDs are supplied, the server takes around 60 seconds to respond and successfully generate the expected ZIP archive (during this time period, no other pages load). A threat actor could issue a request to this endpoint with 100+ statement IDs every 30 seconds, potentially resulting in an overload of the server for all users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://blog.ebankit.com/blog-press; https://packetstormsecurity.com/files/172064/ebankIT-6-Denial-Of-Service.html; https://blog.ebankit.com/blog-press
CVE: CVE-2023-1966
Published: 2023-04-28
Description: Instruments with Illumina Universal Copy Service v1.x and
v2.x contain an unnecessary privileges vulnerability. An unauthenticated
malicious actor could upload and execute code remotely at the operating system
level, which could allow an attacker to change settings, configurations,
software, or access sensitive data on the affected product.






CVSS Score: 7.4 (HIGH)
CWE: CWE-250, CWE-269
References: https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01; https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html
CVE: CVE-2023-1968
Published: 2023-04-28
Description: 
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. 








CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1327
References: https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html; https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01; https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html
CVE: CVE-2023-26021
Published: 2023-04-28
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service as the server may crash when compiling a specially crafted SQL query using a LIMIT clause.  IBM X-Force ID:  247864.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247864; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6985681
CVE: CVE-2023-26022
Published: 2023-04-28
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash when an Out of Memory occurs using the DBMS_OUTPUT module.  IBM X-Force ID:  247868.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/247868; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6985669
CVE: CVE-2023-2386
Published: 2023-04-28
Description: A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.toAddr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227664. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/7; https://vuldb.com/?ctiid.227664; https://vuldb.com/?id.227664
CVE: CVE-2023-2387
Published: 2023-04-28
Description: A vulnerability classified as problematic was found in Netgear SRX5308 up to 4.3.5-3. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=dmz_setup.htm of the component Web Management Interface. The manipulation of the argument winsServer1 leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227665 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/4; https://vuldb.com/?ctiid.227665; https://vuldb.com/?id.227665
CVE: CVE-2023-30454
Published: 2023-04-28
Description: An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be passed to an eval() function and executed upon pressing the continue button.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://blog.ebankit.com/blog-press; https://packetstormsecurity.com/files/172063/ebankIT-6-Cross-Site-Scripting.html; https://blog.ebankit.com/blog-press
CVE: CVE-2020-21643
Published: 2023-04-28
Description: Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Neeke/HongCMS/issues/15; https://github.com/Neeke/HongCMS/issues/15
CVE: CVE-2020-23647
Published: 2023-04-28
Description: Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/boxbilling/boxbilling/issues/596; https://github.com/boxbilling/boxbilling/issues/596
CVE: CVE-2023-26781
Published: 2023-04-28
Description: SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/chshcms/mccms/issues/1; https://github.com/chshcms/mccms/issues/1
CVE: CVE-2023-26782
Published: 2023-04-28
Description: An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://github.com/chshcms/mccms/issues/2; https://github.com/chshcms/mccms/issues/2
CVE: CVE-2023-26812
Published: 2023-04-28
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-26813. Reason: This record is a reservation duplicate of CVE-2023-26813. Notes: All CVE users should reference CVE-2023-26813 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-26813
Published: 2023-04-28
Description: SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/xnx3/wangmarket/issues/7; https://github.com/xnx3/wangmarket/issues/7
CVE: CVE-2023-2388
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, has been found in Netgear SRX5308 up to 4.3.5-3. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/8; https://vuldb.com/?ctiid.227666; https://vuldb.com/?id.227666
CVE: CVE-2023-2389
Published: 2023-04-28
Description: A vulnerability, which was classified as problematic, was found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewall_logs_email.htm of the component Web Management Interface. The manipulation of the argument smtpServer.emailServer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227667. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/9; https://vuldb.com/?ctiid.227667; https://vuldb.com/?id.227667