Vulnerabilities

TI-2023-04542 CVE-2023-4932 · GHSA-v68r-h54c-vpg9

Reflected Cross-Site Scripting in SAS 9.4

LOW 29

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 6.3 Adjacent network Low privileges User interaction EPSS 0.00632 Published 2023-12-12 No fix listed CWE-79

TI-2023-10263 CVE-2023-24724 · GHSA-7fg2-xxpc-hg8m

A stored cross site scripting (XSS) vulnerability was discovered in the user management…

MEDIUM 58

A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editin…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00596 Published 2023-04-03 No fix listed CWE-79

TI-2022-08963 CVE-2022-25256 · GHSA-f94m-q2w2-2g64

SAS Web Report Studio 4.4 allows XSS.

LOW 30

SAS Web Report Studio 4.4 allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01172 Published 2022-02-19 No fix listed CWE-79

TI-2021-18306 CVE-2021-41569 · GHSA-6xqv-9mpx-wxjp

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion.

MEDIUM 44

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07968 Published 2021-11-19 No fix listed CWE-829

TI-2021-14216 CVE-2021-35475 · GHSA-4f3f-rp88-2fqp

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a…

LOW 26

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00945 Published 2021-06-25 No fix listed CWE-79

TI-2020-06187 CVE-2020-7667 · GHSA-9423-6c93-gpp8

Arbitrary File Write via Archive Extraction (Zip Slip)

LOW 36

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01602 Published 2020-06-24 Fixed in 0.1.0 CWE-22

TI-2020-07476 CVE-2020-9350 · GHSA-fj94-48jv-pg96

Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.

LOW 25

Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2020-02-23 No fix listed CWE-79

TI-2019-10901 CVE-2019-14678 · GHSA-65vm-7c4g-83vm

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged…

MEDIUM 48

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02951 Published 2019-11-14 No fix listed CWE-611

TI-2007-06454 CVE-2007-6763 · GHSA-9v4f-qv93-x5wc

SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user…

MEDIUM 41

SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back or forward button in a web browser.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0132 Published 2019-07-31 No fix listed CWE-20

TI-2018-14715 CVE-2018-20733 · GHSA-gw3g-mv3w-862x

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

LOW 35

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01145 Published 2019-01-17 No fix listed CWE-611

TI-2018-14714 CVE-2018-20732 · GHSA-92hw-4jvj-v9ww

SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary…

MEDIUM 49

SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04033 Published 2019-01-17 No fix listed CWE-502

TI-2015-07659 CVE-2015-9281 · GHSA-9mm8-33cv-j397

Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.

LOW 28

Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00647 Published 2019-01-17 No fix listed CWE-79

TI-2014-04452 CVE-2014-5454 · GHSA-ffhh-56c8-8hpq

Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics…

LOW 31

Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.02351 Published 2014-08-25 No fix listed

TI-2014-01793 CVE-2014-2262 · GHSA-fwfc-m344-9jp7

Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2…

MEDIUM 47

Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04273 Published 2014-02-28 No fix listed CWE-119

TI-2002-01937 CVE-2002-2018 · GHSA-cqh8-v9mm-8fcx

sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the…

LOW 32

sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentation fault.

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.0034 Published 2005-07-14 No fix listed

TI-2002-01936 CVE-2002-2017 · GHSA-r986-j2xg-7944

sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the…

MEDIUM 48

sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious program, which is then executed by sastcpd.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02468 Published 2005-07-14 No fix listed

TI-2002-00208 CVE-2002-0219 · GHSA-j7f4-8wcx-2rx9

Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration…

LOW 32

Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via large command line argument.

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.00498 Published 2002-05-03 No fix listed

TI-2002-00207 CVE-2002-0218 · GHSA-pc5x-4ff4-7hrv

Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in…

LOW 32

Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to execute arbitrary code via format specifiers in a command line argument…

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.00428 Published 2002-05-03 No fix listed

Vulnerabilities

Filters