Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 47

Export CSV
CVE-2023-31156

Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-31155

Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-31154

Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-31153

Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code.See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-31152

Authentication Bypass Using an Alternate Path or Channel

An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-31151

Improper Certificate Validation

An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote unauthenticated attacker to conduct a man-in-the-middle (MitM) attack. See SEL Service Bulletin dated 2022-11-15 for more details.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-2241 Rtac Module Sel-2241 Rtac Module Firmware Sel-3350 and 17 more
CVE-2023-34389

Allocation of resources without limits could lead to denial of service

An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to make the system unavailable for an indefinite amount of time. See product Instruction Manual Appendix A dated 20230830 for more details.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-451 Sel-451 Firmware
CVE-2023-34392

Missing Authentication for Critical Function

A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5037 Sel Grid Configurator
CVE-2023-34391

Insecure Inherited Permissions

Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230522 for more details. This issue affects SEL-5033 AcSELerator RTAC Software: before 1.35.151.21000.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Schweitzer Engineering Laboratories Selinc
Products
Windows Sel-5033 Acselerator Rtac Software Sel-5033 Acselerator Real-time Automation Controller
CVE-2023-34390

Improper input validation could lead to denial of service

An input validation vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to create a denial of service against the system and locking out services. See product Instruction Manual Appendix A dated 20230830 for more details.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-451 Sel-451 Firmware
CVE-2023-31177

Improper neutralizataion of input could lead to execution of arbitrary code

An Improper Neutralization of Input During Web Page Generation  ('Cross-site Scripting') in the Schweitzer Engineering Laboratories SEL-451 could allow an attacker to craft a link that could execute arbitrary code on a victim's system. See product Instruction Manual Appendix A dated 20230830 for more details.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-451 Sel-451 Firmware
CVE-2023-31176

Insufficient entropy vulnerability could lead to authentication bypass

An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication.  See product Instruction Manual Appendix A dated 20230830 for more details.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-451 Sel-451 Firmware
CVE-2023-31175

Execution with Unnecessary Privileges

An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5037 Sel Grid Configurator
CVE-2023-31174

Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5037 Sel Grid Configurator
CVE-2023-31173

Use of Hard-coded Credentials

Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5037 SEL Grid Configurator: before 4.5.0.20.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Schweitzer Engineering Laboratories Selinc
Products
Windows Sel-5033 Acselerator Rtac Software Sel-5037 Sel Grid Configurator
CVE-2023-31172

Incomplete Filtering of Special Elements

An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5030 Acselerator Quickset
CVE-2023-31171

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5030 Acselerator Quickset
CVE-2023-31170

Inclusion of Functionality from Untrusted Control Sphere

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5030 Acselerator Quickset
CVE-2023-31169

Improper Handling of Unicode Encoding

An Improper Handling of Unicode Encoding vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5030 Acselerator Quickset
CVE-2023-31168

Inclusion of Functionality from Untrusted Control Sphere

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-5030 acSELerator QuickSet Software: through 7.1.3.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Selinc
Products
Sel-5030 Acselerator Quickset