Sas
18 CVEs across 14 Sas products. Browse Sas vulnerabilities, severities, and proof-of-concept exploits.
Sas products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-4932 | Medium | 6.3 | 2023-12-12 | SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` parameter of the the `/SASStoredProcess/do`… |
CVE-2023-24724 | Medium | 5.4 | 2023-04-03 | A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and… |
CVE-2022-25256 | Medium | 6.1 | 2022-02-19 | SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list… |
CVE-2021-41569 | High | 7.5 | 2021-11-19 | SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the… |
CVE-2021-35475 | Medium | 5.4 | 2021-06-25 | SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties. |
CVE-2020-7667 | High | 7.5 | 2020-06-24 | In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for… |
CVE-2020-9350 | Medium | 5.4 | 2020-02-23 | Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly. |
CVE-2019-14678 | Critical | 10.0 | 2019-11-14 | SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Readi… |
CVE-2007-6763 | High | 8.8 | 2019-07-31 | SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back… |
CVE-2018-20733 | High | 7.5 | 2019-01-17 | BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. |
CVE-2018-20732 | Critical | 9.8 | 2019-01-17 | SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant. |
CVE-2015-9281 | Medium | 6.1 | 2019-01-17 | Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page. |
CVE-2014-5454 | | 2014-08-25 | Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by… | |
CVE-2014-2262 | | 2014-03-01 | Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute ar… | |
CVE-2002-2018 | | 2002-12-31 | sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentation fault. | |
CVE-2002-2017 | | 2002-12-31 | sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program, which is th… | |
CVE-2002-0219 | | 2002-05-16 | Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code… | |
CVE-2002-0218 | | 2002-05-16 | Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute ar… |