CVE-2019-18244

In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during installation or upgrade of PI Vision. The update fixes a previously reported issue...

CVE-2019-18273

OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow invalid input to be introduced...

CVE-2019-18273

CVE-2019-18273 affects OSIsoft PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The root cause is Cross-Site Scripting (CWE-79) due to improper handling of input during web page generation. Impact per documents: potential to introduce invalid input via the affected web interface, with the CVSSv3 base...

CVE-2019-18271

OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site...

CVE-2019-18271

CVE-2019-18271 affects OSIsoft PI Vision (all PI Vision versions prior to 2019) and describes a Cross-Site Request Forgery (CSRF) vulnerability introduced on the PI Vision administration site. The issue is classified under CSRF (CWE-352) with a CVSSv3 base score around 7.1 (vector: AV:N/AC:L/PR:N...

CVE-2019-18275

OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access control, which may return unauthorized tag data when viewing analysis data reference attributes...

CVE-2019-18275

OSIsoft PI Vision (all PI Vision versions prior to 2019) is affected by CVE-2019-18275 due to improper access control that may return unauthorized tag data when viewing analysis data reference attributes. The Red Hat entry confirms the specific vulnerability class and impact, and the CISA advisor...

OSIsoft PI Vision Cross-Site Request Forgery Vulnerability

OSIsoft PI Vision is a set of commercialized software application platform based on Ckient/Server structure from OSIsoft, supporting data acquisition, analysis and visualization. A cross-site request forgery vulnerability exists in OSIsoft PI Vision, which can be exploited by an attacker to...

OSIsoft PI Vision Information Disclosure Vulnerability

OSIsoft PI Vision is a set of commercialized software application platform based on Ckient/Server structure from OSIsoft, supporting data acquisition, analysis and visualization. An information disclosure vulnerability exists in OSIsoft PI Vision, which can be exploited by an attacker to obtain a...

OSIsoft PI Vision Access Control Error Vulnerability

OSIsoft PI Vision is a set of commercialized software application platform based on Ckient/Server structure from OSIsoft, supporting data acquisition, analysis and visualization. The OSIsoft PI Vision Access Control Error vulnerability can be exploited by an attacker to return unauthorized tagged...

CVE-2020-6305

PI Rest Adapter of SAP Process Integration update provided in SAPXIAF 7.31, 7.40, 7.50 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

OSIsoft PI Vision

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: OSIsoft LLC Equipment: PI Vision Vulnerabilities: Improper Access Control, Cross-site Request Forgery CSRF, Cross-site Scripting, Inclusion of Sensitive Information in Log Files 2. RISK EVALUATION...

Unspecified vulnerability in piSignage

piSignage is an HD video digital signage player. A security vulnerability exists in the web application component of piSignage versions prior to 2.6.4. A remote attacker can exploit the vulnerability to download arbitrary files from a Raspberry Pi...

piSignage 2.6.4 - Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Exploit Title: piSignage 2.6.4 - Directory Traversal Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application...

piSignage 2.6.4 - Directory Traversal

Exploit Title: piSignage 2.6.4 - Directory Traversal Date: 2019-11-13 Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application component of piSignage before 2.6.4 allows ...

piSignage 2.6.4 - Directory Traversal

piSignage 2.6.4 - Directory Traversal Exploit Title: piSignage 2.6.4 - Directory Traversal Date: 2019-11-13 Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application...

piSignage 2.6.4 Directory Traversal

Exploit Title: piSignage 2.6.4 - Directory Traversal Date: 2019-11-13 Exploit Author: JunYeong Ko Vendor Homepage: https://pisignage.com/ Version: piSignage before 2.6.4 Tested on: piSignage before 2.6.4 CVE : CVE-2019-20354 Summary: The web application component of piSignage before 2.6.4 allows ...

Path traversal

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

CVE-2019-20354

The web application component of piSignage before 2.6.4 allows a remote attacker authenticated as a low-privilege user to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download...

MyDomoAtHome (MDAH) REST API Domoticz ISS Gateway 0.2.40 Information Disclosure

Summary REST Gateway between Domoticz and Imperihome ISS. Domoticz is a home automation system with a pretty wide library of supported devices, ranging from weather stations to smoke detectors to remote controls, and a large number of additional third-party integrations are documented on the...