Sas

18 CVEs in 14 Sas products, including Integration Technologies, Web Infrastructure Platform, Base. Newest: CVE-2023-4932 (2023-12-12).

Sas products with known CVEs

ProductCVEs
Integration Technologies3
Web Infrastructure Platform3
Base2
Base Sas2
Sas Base2
Sas Integration Technologies2
Visual Analytics2
Environment Manager1
Go Rpm Utils1
Sas Drug Development1
Sas\/intrnet1
Web Administration Interface1
Web Report Studio1
XML Mapper1
Sas CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2023-4932Medium6.32023-12-12SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do`…
CVE-2023-24724Medium5.42023-04-03A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and…
CVE-2022-25256Medium6.12022-02-19SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list…
CVE-2021-41569High7.52021-11-19SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the…
CVE-2021-35475Medium5.42021-06-25SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.
CVE-2020-7667High7.52020-06-24In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for…
CVE-2020-9350Medium5.42020-02-23Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.
CVE-2019-14678Critical10.02019-11-14SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Readi…
CVE-2007-6763High8.82019-07-31SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back…
CVE-2018-20733High7.52019-01-17BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.
CVE-2018-20732Critical9.82019-01-17SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.
CVE-2015-9281Medium6.12019-01-17Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
CVE-2014-54542014-08-25Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by…
CVE-2014-22622014-03-01Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute ar…
CVE-2002-20182002-12-31sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentation fault.
CVE-2002-20172002-12-31sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program, which is th…
CVE-2002-02192002-05-16Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code…
CVE-2002-02182002-05-16Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute ar…