TI-2023-08778 CVE-2023-22583 · GHSA-rw57-p6vv-42wg
SQL Injection in Danfoss AK-EM100
Priority MEDIUM 50
The Danfoss AK-EM100 web forms allow for SQL injection in the login forms.
Danfoss
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
Danfoss records in CISA KEVNo Danfoss vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Ak-em100 Firmware · all components
TI-2023-11165 CVE-2023-25911 · GHSA-r358-c7w3-46x5
Authenticated OS Command Injection in Danfoss AK-EM100
Priority MEDIUM 47
The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters.
TI-2023-08780 CVE-2023-22585 · GHSA-m336-3p9f-8r49
Reflected Cross-Site Scripting in Danfoss AK-EM100
Priority MEDIUM 42
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
TI-2023-08777 CVE-2023-22582 · GHSA-9926-q94j-c3rc
Reflected Cross-Site Scripting in Danfoss AK-EM100
Priority MEDIUM 42
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
TI-2023-08779 CVE-2023-22584 · GHSA-6xpq-789w-crhj
Cleartext credentials in Danfoss AK-EM100
Priority LOW 39
The Danfoss AK-EM100 stores login credentials in cleartext.
TI-2023-08781 CVE-2023-22586 · GHSA-f3qm-vwjc-2pfv
Local File Inclusion in Danfoss AK-EM100
Priority LOW 35
The Danfoss AK-EM100 web applications allow for Local File Inclusion in the file parameter.
TI-2023-11166 CVE-2023-25912 · GHSA-p3xm-g7cx-5qfp
Webreport disclosure to unauthorized actor in Danfoss AK-EM100
Priority LOW 31
The webreport generation feature in the Danfoss AK-EM100 allows an unauthorized actor to generate a web report that discloses sensitive information such as the internal IP address, usernames and internal device values.