Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s: - https://github.com/tauri-apps/tauri/security/advisories/GHSA-4wm2-cwcf-wwvp - https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.9 - https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.1.4 - https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.2.5 - https://www.github.com/tauri-apps/tauri/commit/58ea0b45268dbd46cbac0ebb0887353d057ca767 - https://www.github.com/tauri-apps/tauri/commit/fa90214b052b1a5d38d54fbf1ca422b4c37cfd1f
CVE ID: CVE-2023-31135 State: PUBLISHED Published: 2023-05-17T17:04:52.138Z Last Updated: 2025-01-22T16:46:46.241Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: dgraph-io Products: dgraph Problem Types: CWE-326 Description: Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being encrypted. This is problematic because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many t
c because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many times. All audit logs generated by versions of Dgraph <v23.0.0 are affected. Attackers must have access to the system the logs are stored on. Dgraph users should upgrade to v23.0.0. Users unable to upgrade should store existing audit logs in a secure location and for extra security, encrypt using an external tool like `gpg`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-92wq-q9pq-gw47 - https://github.com/dgraph-io/dgraph/pull/8323 - https://en.wikipedia.org/wiki/Cryptogr
/advisories/GHSA-92wq-q9pq-gw47 - https://github.com/dgraph-io/dgraph/pull/8323 - https://en.wikipedia.org/wiki/Cryptographic_nonce
CVE ID: CVE-2023-31136 State: PUBLISHED Published: 2023-05-09T13:37:38.193Z Last Updated: 2025-01-28T17:05:03.749Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vapor Products: postgres-nio Problem Types: CWE-522 Description: PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users. Addition
is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vv - https://github.com/apple/swift-nio/pull/2419 - https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7 - https://github.com/advisories/GHSA-467w-rrqc-395f - https://github.com/advisories/GHSA-735f-7qx4-jqq5 - https://github.com/vapor/postgres-nio/releases/tag/1.14.2 - https://www.postgresql.org/support/security/CVE-2021-23214/ - https://www.postgresql.org/support/security/CVE-2021-2322
https://www.postgresql.org/support/security/CVE-2021-23214/ - https://www.postgresql.org/support/security/CVE-2021-23222/
CVE ID: CVE-2023-31137 State: PUBLISHED Published: 2023-05-09T13:56:46.219Z Last Updated: 2025-02-13T16:49:46.296Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: samboy Products: MaraDNS Problem Types: CWE-191 Description: MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination. The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qty
in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service. One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in ver
fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/samboy/MaraDNS/security/advisories/GHSA-58m7-826v-9c3c - https://github.com/samboy/MaraDNS/commit/bab062bde40b2ae8a91eecd522e84d8b993bab58 - https://github.com/samboy/MaraDNS/blob/08b21ea20d80cedcb74aa8f14979ec7c61846663/dns/Decompress.c#L886 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/ - https://lists.fedoraproject.
s/list/package-announce@lists.fedoraproject.org/message/NB7LDZM5AGWC5BHHQHW6CP5OFNBBKFOQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3VSMLJX25MXGQ6A7UPOGK7VPUVDESPHL/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00019.html - https://www.debian.org/security/2023/dsa-5441
CVE ID: CVE-2023-31138 State: PUBLISHED Published: 2023-05-09T14:11:11.868Z Last Updated: 2025-01-28T17:03:42.145Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: dhis2 Products: dhis2-core Problem Types: CWE-284, CWE-863 Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an object may be able to modify related objects that they should not have access to. DHIS2 implementers should upgrade to a supported version o
o modify related objects that they should not have access to. DHIS2 implementers should upgrade to a supported version of DHIS2 to receive a patch: 2.37.9.1, 2.38.3.1, or 2.39.1.2. It is possible to work around this issue by blocking all PATCH requests on a reverse proxy, but this may cause some issues with the functionality of built-in applications using legacy PATCH requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwvw-4m67-f4g2 - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md - https://github.com/dhis2/dhis2-releases/blob/master/release
releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.39.1.2.md
CVE ID: CVE-2023-31139 State: PUBLISHED Published: 2023-05-09T14:27:22.658Z Last Updated: 2025-01-28T17:02:24.727Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: dhis2 Products: dhis2-core Problem Types: CWE-613 Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.
e, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3 - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md - https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.39.1.2.md
CVE ID: CVE-2023-31140 State: PUBLISHED Published: 2023-05-08T20:27:48.218Z Last Updated: 2025-01-29T14:55:24.204Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: opf Products: openproject Problem Types: CWE-613 Description: OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolve
es a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opf/openproject/securit
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q - https://github.com/opf/openproject/pull/12508 - https://community.openproject.org/wp/48035 - https://www.openproject.org/docs/release-notes/12-5-4/
CVE ID: CVE-2023-31141 State: PUBLISHED Published: 2023-05-08T20:33:58.601Z Last Updated: 2025-01-29T14:54:25.850Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: opensearch-project Products: security Problem Types: CWE-863 Description: OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For thi
lied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opensearch-project/security/security/advisories/GHSA-g8xc-6mf7-h28h
CVE ID: CVE-2023-31142 State: PUBLISHED Published: 2023-06-13T21:12:47.664Z Last Updated: 2025-01-02T21:02:40.153Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-732 Description: Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default. This issue is patched in version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A workaround, only if you are modifying the general c
and version 3.1.0.beta5 of the `beta` and `tests-passed` branches. A workaround, only if you are modifying the general category permissions, is to use a new category for the same purpose. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-286w-97m2-78x2
CVE ID: CVE-2023-31143 State: PUBLISHED Published: 2023-05-09T14:59:42.330Z Last Updated: 2025-01-28T16:58:09.069Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: mage-ai Products: mage-ai Problem Types: CWE-306 Description: mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
on 0.8.72 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7 - https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650
CVE ID: CVE-2023-31144 State: PUBLISHED Published: 2023-05-09T15:22:39.915Z Last Updated: 2025-01-28T16:40:41.526Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: craftcms Products: cms Problem Types: CWE-79 Description: Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6 - https://github.com/craftcms/cms/commit/52bd16
https://github.com/craftcms/cms/security/advisories/GHSA-j4mx-98hw-6rv6 - https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442
CVE ID: CVE-2023-31145 State: PUBLISHED Published: 2023-05-15T20:58:32.479Z Last Updated: 2025-01-22T21:18:48.370Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CollaboraOnline Products: online Problem Types: CWE-79 Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account takeover attack. The vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the v
he vulnerability allows attackers to inject malicious code into web pages, which can be executed in the context of the victim's browser session. This means that an attacker can steal sensitive data, such as login credentials or personal information, or perform unauthorized actions on behalf of the victim, such as modifying or deleting data. In this specific case, the vulnerability allows for a trivial account takeover attack. An attacker can exploit the vulnerability to inject code into the victim's browser session, allowing the attacker to take over the victim's account without their knowledge or consent. This can lead to unauthorized access to sensitive information and data, as well as the
thout their knowledge or consent. This can lead to unauthorized access to sensitive information and data, as well as the ability to perform actions on behalf of the victim. Furthermore, the fact that the vulnerability bypasses the Content Security Policy (CSP) makes it more dangerous, as CSP is an important security mechanism used to prevent cross-site scripting attacks. By bypassing CSP, attackers can circumvent the security measures put in place by the web application and execute their malicious code. This issue has been patched in versions 22.05.13, 21.11.9, and 6.4.27. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Pro
Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CollaboraOnline/online/security/advisories/GHSA-rqj2-2c2x-gjmm
CVE ID: CVE-2023-31146 State: PUBLISHED Published: 2023-05-11T20:51:51.666Z Last Updated: 2025-01-24T16:02:08.702Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-787 Description: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 cont
corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vyperlang/vyper/security/advisories/GHSA-3p37-3636-q8wv - https://github.com/vyperlang/vyper/commit/4f8289a81206f767df1900ac48f485d90fc87edb
CVE ID: CVE-2023-31147 State: PUBLISHED Published: 2023-05-25T21:55:47.585Z Last Updated: 2025-02-13T16:49:46.904Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: c-ares Products: c-ares Problem Types: CWE-330 Description: c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for mo
pilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2 - https://github.com/c-ares/c-ares/releases/tag/cares-1_19_1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Z5XFNXTNPTCBBVXFDNZQVLLIE6VRBY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV
IE6VRBY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFWILTA33LOSV23P44FGTQQIDRJHIY7/ - https://security.gentoo.org/glsa/202310-09
CVE ID: CVE-2023-31148 State: PUBLISHED Published: 2023-05-10T19:20:03.147Z Last Updated: 2025-01-27T18:19:19.558Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Schweitzer Engineering Laboratories Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-20 Description: An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - C
ker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://selinc.com/support/security-notifications/external-reports/ - https://www.nozominetworks.com/blog/
CVE ID: CVE-2023-31149 State: PUBLISHED Published: 2023-05-10T19:20:16.373Z Last Updated: 2025-01-27T18:18:20.153Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Schweitzer Engineering Laboratories Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-20 Description: An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote authenticated attacker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - C
CVE ID: CVE-2023-31150 State: PUBLISHED Published: 2023-05-10T19:21:07.126Z Last Updated: 2025-01-27T18:17:15.598Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Schweitzer Engineering Laboratories Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-257 Description: A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database system could allow an authenticated attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: -
attacker to retrieve passwords. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://selinc.com/support/security-notifications/external-reports/ - https://www.nozominetworks.com/blog/
CVE ID: CVE-2023-31151 State: PUBLISHED Published: 2023-05-10T19:21:30.649Z Last Updated: 2025-01-24T19:04:04.464Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Schweitzer Engineering Laboratories Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-295 Description: An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface could allow a remote unauthenticated attacker to conduct a man-in-the-middle (MitM) attack. See SEL Service Bulletin dated 2022-11-15 for more details. Add
d attacker to conduct a man-in-the-middle (MitM) attack. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://selinc.com/support/security-notifications/external-reports/ - https://www.nozominetworks.com/blog/
CVE ID: CVE-2023-31152 State: PUBLISHED Published: 2023-05-10T19:21:50.029Z Last Updated: 2025-01-24T19:04:25.192Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Schweitzer Engineering Laboratories Products: SEL-3505, SEL-3505-3, SEL-3530, SEL-3530-4, SEL-3532, SEL-3555, SEL-3560S, SEL-3560E, SEL-2241 RTAC module, SEL-3350 Problem Types: CWE-288 Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more details. Additional Analyst Notes: - CVE Program Co