Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: OSIsoft Component: Pi Web Api Clear all filters
TI-2021-19439 CVE-2021-43549 · GHSA-pj89-mr75-5fmf

Cross-site scripting in OSIsoft PI Web API

Priority LOW 32

A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00711 Published 2021-11-18 No fix listed CWE-79
TI-2020-09680 CVE-2020-12021 · GHSA-q4j7-8h9j-7jxq

Cross-site scripting in OSIsoft PI Web API 2019

Priority MEDIUM 42

In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0157 Published 2020-06-23 No fix listed CWE-79
TI-2019-10148 CVE-2019-13516 · GHSA-xrq8-5w86-wqq2

Protection mechanism failure in OSIsoft PI Web API

Priority LOW 39

In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00662 Published 2019-08-15 No fix listed CWE-693
TI-2018-05417 CVE-2018-7508 · GHSA-rh53-fxfh-q9v6

Cross-site scripting in OSIsoft PI Web API

Priority LOW 29

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00825 Published 2018-03-14 No fix listed CWE-79
TI-2018-05409 CVE-2018-7500 · GHSA-qvpm-fp2p-7wm3

Access control flaw in OSIsoft PI Web API

Priority MEDIUM 46

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01848 Published 2018-03-14 No fix listed CWE-264
TI-2017-05535 CVE-2017-7926 · GHSA-cvq2-wv4h-23w5

Cross-site request forgery in OSIsoft PI Web API 2017

Priority MEDIUM 40

A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0).

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00826 Published 2017-08-25 No fix listed CWE-352
TI-2017-03271 CVE-2017-5153 · GHSA-gp6c-fp2m-24q3

Sensitive information in log files in OSIsoft PI Coresight and PI Web API

Priority LOW 34

An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00374 Published 2017-02-13 No fix listed CWE-532