OSIsoft PI Vision
The affected product is vulnerable to an improper access control, which may return unauthorized tag data when viewing analysis data reference attributes.CVE-2019-18275 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI Vision administration site.CVE-2019-18271 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). The affected product is vulnerable to cross-site scripting, which may allow invalid input to be introduced.CVE-2019-18273 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H). The affected product records the service account password in the installation log files when a non-default service account and password are specified during installation or upgrade.CVE-2019-18244 has been assigned to this vulnerability. A CVSS v3 base score of 5.1 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).