CVE-2023-2392

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. Affected is an unknown function of the file scgi-bin/platform.cgi?page=time_zone.htm of the component Web Management Interface. The manipulation of the argument ManualDate.minutes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-227670 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239204.2An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search a CVE-2023-239216.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remot CVE-2023-239226.1The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can CVE-2023-239238.2The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set th CVE-2023-239249.8Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with upperca CVE-2023-239257.5Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match CVE-2023-239268.1APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.grap CVE-2023-239275.4Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cros CVE-2023-239289.8reason-jose is a JOSE implementation in ReasonML and OCaml.`Jose.Jws.validate` does not check HS256 signatures. This allows tampering of JWS CVE-2023-239298.8vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefi CVE-2023-23934.8A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been declared as problematic. Affected by this vulnerability is an unknow CVE-2023-239307.2vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a d