Vulnerabilities > Danfoss
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-08-21 | CVE-2023-25913 | Improper Authentication vulnerability in Danfoss Ak-Sm 800A Firmware 3.3 Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information. | 7.5 |
| 2023-08-21 | CVE-2023-25914 | Path Traversal vulnerability in Danfoss Ak-Sm 800A Firmware 3.3 Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. | 7.5 |
| 2023-08-21 | CVE-2023-25915 | Unspecified vulnerability in Danfoss Ak-Sm 800A Firmware 3.3 Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system. | 9.8 |
| 2023-06-11 | CVE-2023-22582 | Cross-site Scripting vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting. | 6.1 |
| 2023-06-11 | CVE-2023-22583 | SQL Injection vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 web forms allow for SQL injection in the login forms. | 9.8 |
| 2023-06-11 | CVE-2023-22584 | Cleartext Storage of Sensitive Information vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 stores login credentials in cleartext. | 7.5 |
| 2023-06-11 | CVE-2023-22585 | Cross-site Scripting vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter. | 6.1 |
| 2023-06-11 | CVE-2023-22586 | Information Exposure vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter. | 7.5 |
| 2023-06-11 | CVE-2023-25911 | Command Injection vulnerability in Danfoss Ak-Em100 Firmware The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters. | 9.8 |
| 2023-06-11 | CVE-2023-25912 | Information Exposure vulnerability in Danfoss Ak-Em100 Firmware The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values. | 5.3 |