GCVE - cpe:2.3:a:osisoft:pi_web_api:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:osisoft:pi_web_api:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Osisoft (`773be19d-2e5d-5fef-8fcd-1eaca9773a63`)
Product	Pi Web Api (`0d35ca5f-dc67-5c26-9929-464d31f5f795`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/osisoft/sample-pi_web_api-common_actions-angular`	purl2cpe	2026-06-01 10:13:04.912308
`pkg:github/z-burke/osisoft-pi-web-api-samples`	purl2cpe	2026-06-01 10:13:04.912310
`pkg:npm/node-red-contrib-osisoft-web-api`	purl2cpe	2026-06-01 10:13:04.912313

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-43549`	vulnerable	2026-06-08 05:36:43.535011	OSIsoft PI Web API MEDIUM (6.9) A remote authenticated attacker with write access to a PI Server could trick a user into interacting with a PI Web API endpoint and redirect them to a malicious website. As a result, a victim may disclose sensitive information to the attacker or be provided with false information. Published: 2021-11-18T14:18:48.609Z Updated: 2024-09-16T23:00:26.909Z Open on db.gcve.eu Reference links https://us-cert.cisa.gov/ics/advisories/icsa-21-313-06	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12021`	vulnerable	2026-06-08 05:17:56.200685	Details available In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code. Published: 2020-06-23T21:36:23.000Z Updated: 2024-08-04T11:48:57.978Z Open on db.gcve.eu Reference links https://www.us-cert.gov/ics/advisories/icsa-20-163-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13516`	vulnerable	2026-06-08 05:12:51.914878	Details available In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect. Published: 2019-08-15T18:49:15.000Z Updated: 2024-08-04T23:57:39.193Z Open on db.gcve.eu Reference links https://www.us-cert.gov/ics/advisories/icsa-19-225-02	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13515`	vulnerable	2026-06-08 05:12:51.914365	Details available OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information. Published: 2019-08-15T18:39:36.000Z Updated: 2024-08-04T23:57:39.455Z Open on db.gcve.eu Reference links https://www.us-cert.gov/ics/advisories/icsa-19-225-02	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7508`	vulnerable	2026-06-08 05:12:03.782719	Details available A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutralized. Published: 2018-03-14T18:00:00.000Z Updated: 2024-08-05T06:31:03.702Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/103396 https://ics-cert.us-cert.gov/advisories/ICSA-18-072-04	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7500`	vulnerable	2026-06-08 05:12:03.771327	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.