Read the docs

OSIsoft

Records45All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high16CVSS 7.0–8.9

Exploited now

OSIsoft records in CISA KEV

No OSIsoft vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pi Vision 15 records MEDIUM Pi Data Archive 11 records LOW Pi Web Api 8 records MEDIUM Pi Buffer Subsystem 4 records LOW Pi Interface 4 records LOW Pi Api 3 records LOW Pi Connector 3 records LOW Pi Connector Relay 3 records LOW

Records

8 records in Pi Web Api · all components

TI-2018-05409 CVE-2018-7500 · GHSA-qvpm-fp2p-7wm3

Access control flaw in OSIsoft PI Web API

Priority MEDIUM 46

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01848 Published 2018-03-14 No fix listed CWE-264
TI-2020-09680 CVE-2020-12021 · GHSA-q4j7-8h9j-7jxq

Cross-site scripting in OSIsoft PI Web API 2019

Priority MEDIUM 42

In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0157 Published 2020-06-23 No fix listed CWE-79
TI-2017-05535 CVE-2017-7926 · GHSA-cvq2-wv4h-23w5

Cross-site request forgery in OSIsoft PI Web API 2017

Priority MEDIUM 40

A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0).

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00826 Published 2017-08-25 No fix listed CWE-352
TI-2019-10148 CVE-2019-13516 · GHSA-xrq8-5w86-wqq2

Protection mechanism failure in OSIsoft PI Web API

Priority LOW 39

In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00662 Published 2019-08-15 No fix listed CWE-693
TI-2017-03271 CVE-2017-5153 · GHSA-gp6c-fp2m-24q3

Sensitive information in log files in OSIsoft PI Coresight and PI Web API

Priority LOW 34

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00374 Published 2017-02-13 No fix listed CWE-532
TI-2021-19439 CVE-2021-43549 · GHSA-pj89-mr75-5fmf

Cross-site scripting in OSIsoft PI Web API

Priority LOW 32

A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00711 Published 2021-11-18 No fix listed CWE-79
TI-2018-05417 CVE-2018-7508 · GHSA-rh53-fxfh-q9v6

Cross-site scripting in OSIsoft PI Web API

Priority LOW 29

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00825 Published 2018-03-14 No fix listed CWE-79
Open these records in search →