Vendor
Schweitzer Engineering Laboratories
63 known vulnerabilities.
Products
12 results · Clear filters · Feed
-
High 7.5
Deserialization of Untrusted Data
An authenticated user can modify application state data.
-
High 7.5
Improper Restriction of Excessive Authentication Attempts
Password guessing limits could be bypassed when using LDAP authentication.
-
High 7.5
Improper Handling of Insufficient Permissions
An authenticated user without user administrative permissions could change the administrator Account Name.
-
High 8.1
Improper Restriction of Excessive Authentication Attempts
An unauthenticated user could discover account credentials via a brute-force attack without rate limiting
-
High 7.4
Origin Validation Error
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected…
-
High 7.5
Insufficient entropy vulnerability could lead to authentication bypass
An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication. See product Instruction Manual Appendix A dated 20230830 for more…
-
High 8.2
Missing Authentication for Critical Function
A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manua…
-
High 7.4
Insecure Inherited Permissions
Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230…
-
High 8.8
Execution with Unnecessary Privileges
An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A a…
-
High 7.4
Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery (CSRF) vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to embed instructions that could be executed by an authorized device operator. See Instruction Manual Appendix …
-
High 7.7
Use of Hard-coded Credentials
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL…
-
High 8.0
Storing Passwords in a Recoverable Format
A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11…