CVE-2018-7500

CVE-2018-7500 affects OSIsoft PI Web API (versions 2017 R2 and prior). The issue is Privileges may be escalated, allowing access to the PI System via the service account. CVSS information in NVD indicates high/critical impact (CS: high for confidentiality, integrity, availability; network vector;...

CVE-2018-7531

CVE-2018-7531 affects the OSIsoft PI Data Archive (versions 2017 and earlier). The issue is an improper input validation allowing unauthenticated attackers to send unvalidated custom requests that crash the PI Data Archive server, impacting availability (CWE-20). The NVD entry provides a CVSS v3 ...

CVE-2018-7496

CVE-2018-7496 affects OSIsoft PI Vision 2017 and earlier. The vulnerability is a Information Exposure (CWE-200) where server response header and referrer-policy header disclose unintended information. ICSA-18-072-03 notes an affected product: PI Vision versions 2017 and prior, with CVSS v3 base s...

CVE-2018-7533

An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation of privileges that gives the actor full control over the system...

CVE-2018-7496

An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header and referrer-policy response header each provide unintended information disclosure...

CVE-2018-7529

A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server...

CVE-2018-7531

An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests to crash the server...

CVE-2018-7504

A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting...

OSIsoft PI Data Archive Denial of Service Vulnerability

OSIsoft PI Data Archive is an efficient storage and archiving component that enables high performance data retrieval through client software. A denial of service vulnerability exists in OSIsoft PI Data Archive 2017 and prior versions. An unauthenticated attacker uses unauthenticated custom reques...

OSIsoft PI Vision Cross-Site Scripting Vulnerability

PI Vision is the leading visualization tool for quick, easy and secure access to all PI System™ data. A cross-site scripting vulnerability exists in OSIsoft PI Vision 2017 and prior versions, which can be exploited by remote attackers to inject arbitrary web script or HTML because the...

OSIsoft PI Web API Cross-Site Scripting Vulnerability

The OSIsoft PI Web API is a product for accessing PI system data. A cross-site scripting vulnerability exists in OSIsoft PI Web API 2017 R2 and prior versions, which can be exploited by remote attackers to inject arbitrary web script or HTML...

OSIsoft PI Vision Information Disclosure Vulnerability

PI Vision is the leading visualization tool for quick, easy and secure access to all PI System™ data. An information disclosure vulnerability exists in OSIsoft PI Vision 2017 and prior versions, which can be exploited by attackers to obtain sensitive information...

OSIsoft PI Data Archive Denial of Service Vulnerability (CNVD-2018-05303)

OSIsoft PI Data Archive is an efficient storage and archiving component that enables high performance data retrieval through client software. A denial-of-service vulnerability exists in OSIsoft PI Data Archive 2017 and prior versions, which can be exploited by an unauthenticated attacker to modif...

OSIsoft PI Data Archive Elevation of Privilege Vulnerability

OSIsoft PI Data Archive is an efficient storage and archiving component that enables high performance data retrieval through client software. An elevation of privilege vulnerability exists in OSIsoft PI Data Archive 2017 and prior versions, which can be exploited by an attacker to escalate...

OSIsoft PI Vision

CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: OSIsoft Equipment: PI Vision Vulnerabilities: Protection Mechanism Failure, Information Exposure AFFECTED PRODUCTS The following versions of PI Vision, a data visualization framework, are affected: PI Vision versions...

OSIsoft PI Web API

CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API Vulnerabilities: Permissions, Privileges, and Access Controls; Cross-site Scripting AFFECTED PRODUCTS OSIsoft reports that the vulnerabilities affect the following PI Web API products: PI...

OSIsoft PI Data Archive

CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Data Archive Vulnerabilities: Deserialization of Untrusted Data, Improper Input Validation, Incorrect Default Permissions AFFECTED PRODUCTS The following versions of PI Data Archive, a data stora...

Cross site request forgery (csrf)

A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 1.9.0. The vulnerability allows cross-site request forgery CSRF attacks to occur when an otherwise-unauthorized cross-site request is sent from a browser the server has previously authenticated...

CVE-2017-7934

An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versions contains a flaw that could allow a malicious user to authenticate with a server and then cause PI Network Manager to behave in an...

CVE-2017-7926

A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 1.9.0. The vulnerability allows cross-site request forgery CSRF attacks to occur when an otherwise-unauthorized cross-site request is sent from a browser the server has previously authenticated...