CVE-2018-7496: Exposure of Sensitive Information to an Unauthorized Actor

An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header and referrer-policy response header each provide unintended information disclosure...

PT-2018-18111

Name of the Vulnerable Software and Affected Versions OSIsoft PI Vision versions 2017 and prior Description A Protection Mechanism Failure issue was discovered, where the X-XSS-Protection response header is not set to block, allowing attempts at reflected cross-site scripting. Recommendations For...

PT-2018-18136

Name of the Vulnerable Software and Affected Versions OSIsoft PI Data Archive versions prior to 2018 Description An issue with improper input validation was found, allowing unauthenticated users to potentially crash the server by sending custom, unvalidated requests. Recommendations For OSIsoft P...

OSIsoft PI Vision Cross-Site Scripting Vulnerability

PI Vision is the leading visualization tool for quick, easy and secure access to all PI System™ data. A cross-site scripting vulnerability exists in OSIsoft PI Vision 2017 and prior versions, which can be exploited by remote attackers to inject arbitrary web script or HTML because the...

OSIsoft PI Data Archive Elevation of Privilege Vulnerability

OSIsoft PI Data Archive is an efficient storage and archiving component that enables high performance data retrieval through client software. An elevation of privilege vulnerability exists in OSIsoft PI Data Archive 2017 and prior versions, which can be exploited by an attacker to escalate...

CVE-2018-7500: Undefined Security Weakness

A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attackers access to the PI System via the service account...

PT-2018-18138

Name of the Vulnerable Software and Affected Versions OSIsoft PI Data Archive versions 2017 and prior Description An issue with incorrect default permissions was found, which may allow an actor to escalate privileges and gain full control over the system due to an insecure default configuration...

PT-2018-18104

Name of the Vulnerable Software and Affected Versions OSIsoft PI Vision versions 2017 and prior Description An Information Exposure issue was discovered, where the server response header and referrer-policy response header each provide unintended information disclosure. Recommendations For OSIsof...

OSIsoft PI Web API Elevation of Privilege Vulnerability

The OSIsoft PI Web API is a product for accessing PI system data. An elevation of privilege vulnerability exists in OSIsoft PI Web API 2017 R2 and prior versions that could allow an attacker to access the PI System via a service account...

CVE-2018-7531: Improper Input Validation

An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests to crash the server...

CVE-2018-7533: Incorrect Default Permissions

An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation of privileges that gives the actor full control over the system...

CVE-2018-7508: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized...

PT-2018-18108

Name of the Vulnerable Software and Affected Versions OSIsoft PI Web API versions 2017 R2 and prior Description A Permissions, Privileges, and Access Controls issue was discovered, allowing privileges to be escalated. This escalation gives attackers access to the PI System via the service account...

CVE-2018-7529: Deserialization of Untrusted Data

A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server...

OSIsoft PI Vision

CVSS v3 6.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: OSIsoft Equipment: PI Vision Vulnerabilities: Protection Mechanism Failure, Information Exposure AFFECTED PRODUCTS The following versions of PI Vision, a data visualization framework, are affected: PI Vision versions...

OSIsoft PI Data Archive

CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Data Archive Vulnerabilities: Deserialization of Untrusted Data, Improper Input Validation, Incorrect Default Permissions AFFECTED PRODUCTS The following versions of PI Data Archive, a data stora...

OSIsoft PI Web API

CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: OSIsoft Equipment: PI Web API Vulnerabilities: Permissions, Privileges, and Access Controls; Cross-site Scripting AFFECTED PRODUCTS OSIsoft reports that the vulnerabilities affect the following PI Web API products: PI...

USN-3581-3: Linux kernel (Raspberry Pi 2) vulnerabilities

Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2017-17712 ChunYu Wang discovered that a...

Linux/ARM - Bind TCP (4444/TCP) Shell (/bin/sh) + IP Controlled (192.168.1.190) + Null-Free Shellcod

/ Title: Linux/ARM - IP Controlled Bind Shell TCP /bin/sh. Null free shellcode 168 bytes Date: 2018-02-17 Tested: armv7l Raspberry Pi v3 and armv6l Raspberry Pi Zero W Author: rtmcx - twitter: @rtmcx Description: The shellcode will only allow the connection to execute the shell if originating fro...

Linux/ARM - Bind TCP (4444/TCP) Shell (/bin/sh) + IP Controlled (192.168.1.190) + Null-Free Shellcode (168 bytes)

Linux/ARM - Bind TCP 4444/TCP Shell /bin/sh + IP Controlled 192.168.1.190 + Null-Free Shellcode 168 bytes. Shellcode exploit for ARM platform / Title: Linux/ARM - IP Controlled Bind Shell TCP /bin/sh. Null free shellcode 168 bytes Date: 2018-02-17 Tested: armv7l Raspberry Pi v3 and armv6l Raspber...