Skip to content
Noroxi

sas records

21 published records for vendor sas.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
9.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

21 records
  • CVE-2019-14678
    41Plan

    SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways.

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    sas · xml mapperNov 14, 2019

  • CVE-2002-2017
    41Plan

    sastcpd in SAS/Base 8.0 allows local users to execute arbitrary code by setting the authprog environment variable to reference a malicious p

    CriticalCVSS 10.0No exploitEPSS 2%

    sas · baseDec 31, 2002

  • CVE-2018-20732
    40Plan

    SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

    CriticalCVSS 9.8No exploitEPSS 4%

    sas · web infrastructure platformJan 16, 2019

  • CVE-2014-2262
    38Monitor

    Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote atta

    CriticalCVSS 9.3No exploitEPSS 4%

    sas · base sasFeb 28, 2014

  • CVE-2007-6763
    35Monitor

    SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources

    HighCVSS 8.8No exploitEPSS 1%

    sas · sas drug developmentJul 31, 2019

  • CVE-2024-48733
    35Monitor

    SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL

    HighCVSS 8.8No exploitEPSS 0%

    Oct 30, 2024

  • CVE-2024-48734
    35Monitor

    Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malic

    HighCVSS 8.8No exploitEPSS 0%

    Oct 30, 2024

  • CVE-2021-41569
    32Monitor

    SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion.

    HighCVSS 7.5Proof of conceptEPSS 7%

    sas · sas\/intrnetNov 19, 2021

  • CVE-2020-7667
    30Monitor

    Arbitrary File Write via Archive Extraction (Zip Slip)

    HighCVSS 7.5No exploitEPSS 1%

    sas · go rpm utilsJun 24, 2020

  • CVE-2018-20733
    30Monitor

    BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

    HighCVSS 7.5No exploitEPSS 1%

    sas · web infrastructure platformJan 16, 2019

  • CVE-2024-48735
    30Monitor

    Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access i

    HighCVSS 7.7No exploitEPSS 0%

    Oct 30, 2024

  • CVE-2002-0219
    28Monitor

    Buffer overflow in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local users to exe

    HighCVSS 7.2No exploitEPSS 0%

    sas · sas baseMay 16, 2002

  • CVE-2002-0218
    28Monitor

    Format string vulnerability in (1) sastcpd in SAS/Base 8.0 and 8.1 or (2) objspawn in SAS/Integration Technologies 8.0 and 8.1 allows local

    HighCVSS 7.2No exploitEPSS 0%

    sas · sas baseMay 16, 2002

  • CVE-2002-2018
    28Monitor

    sastcpd in SAS/Base 8.0 might allow local users to gain privileges by setting the netencralg environment variable, which causes a segmentati

    HighCVSS 7.2No exploitEPSS 0%

    sas · baseDec 31, 2002

  • CVE-2014-5454
    25Monitor

    Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute

    MediumCVSS 6.0No exploitEPSS 2%

    sas · visual analyticsAug 25, 2014

  • CVE-2022-25256
    24Monitor

    SAS Web Report Studio 4.4 allows XSS.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    sas · web report studioFeb 18, 2022

  • CVE-2015-9281
    24Monitor

    Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.

    MediumCVSS 6.1No exploitEPSS 0%

    sas · web infrastructure platformJan 16, 2019

  • CVE-2021-35475
    21Monitor

    SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    sas · environment managerJun 25, 2021

  • CVE-2023-4932
    21Monitor

    Reflected Cross-Site Scripting in SAS 9.4

    MediumCVSS 5.4No exploitEPSS 0%

    sas · integration technologiesDec 12, 2023

  • CVE-2023-24724
    21Monitor

    A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insuffic

    MediumCVSS 5.4No exploitEPSS 0%

    sas · web administration interfaceApr 3, 2023

  • CVE-2020-9350
    21Monitor

    Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.

    MediumCVSS 5.4No exploitEPSS 0%

    sas · visual analyticsFeb 22, 2020