Osisoft Pi Web Api
8 CVEs affecting Osisoft Pi Web Api. Latest disclosed: 2021-11-18. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7500 | Critical | 9.8 | 2018-03-14 | A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attac… |
CVE-2020-12021 | Critical | 9.0 | 2020-06-23 | In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allo… |
CVE-2019-13516 | High | 8.8 | 2019-08-15 | In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not take… |
CVE-2017-7926 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CS… |
CVE-2017-5153 | High | 7.8 | 2017-02-13 | An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated… |
CVE-2021-43549 | Medium | 6.9 | 2021-11-18 | A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a maliciou… |
CVE-2019-13515 | Medium | 6.5 | 2019-08-15 | OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information. |
CVE-2018-7508 | Medium | 6.1 | 2018-03-14 | A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutrali… |