CVE-2023-24464

Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier

• CWE-79
• CWE-79

• https://jvn.jp/en/vu/JVNVU96824262/Third Party Advisory, VDB Entry
• https://www.buffalo.jp/news/detail/20230310-01.htmlPatch, Vendor Advisory
• https://jvn.jp/en/vu/JVNVU96824262/Third Party Advisory, VDB Entry
• https://www.buffalo.jp/news/detail/20230310-01.htmlPatch, Vendor Advisory

Published

Apr 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24458A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8
• CVE-2023-24459A missing permission check in Jenkins BearyChat Plugin 3.0.2…6.5
• CVE-2023-2446The UserPro plugin for WordPress is vulnerable to sensitive …6.5
• CVE-2023-24460Incorrect default permissions in some Intel(R) GPA software …7.8
• CVE-2023-24461 An improper certificate validation vulnerability exists in …5.9
• CVE-2023-24463Improper input validation in some Intel(R) Thunderbolt(TM) D…4.3
• CVE-2023-24465Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and …5.5
• CVE-2023-24466Possible XML External Entity Injection in iManager GET pa…9.8
• CVE-2023-24467Possible Command Injection in iManager GET parameter has …9.8
• CVE-2023-24468Broken access control in Advanced Authentication versions pr…9.8
• CVE-2023-24469Potential Cross-Site Scripting in ArcSight Logger versions p…6.1
• CVE-2023-2447The UserPro plugin for WordPress is vulnerable to Cross-Site…6.1