CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2018-20733
https://notcve.org/view.php?id=CVE-2018-20733
BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE. BI Web Services en SAS Web Infrastructure Platform en versiones anteriores a la 9.4M6 permite XEE (XML External Entity). • http://support.sas.com/kb/62/987.html • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 0CVE-2015-9281
https://notcve.org/view.php?id=CVE-2015-9281
Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page. Logon Manager en SAS Web Infrastructure Platform, en versiones anteriores a la 9.4M3, permite Cross-Site Scripting (XSS) reflejado en la página Timeout. • http://support.sas.com/kb/55/537.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2018-20732
https://notcve.org/view.php?id=CVE-2018-20732
SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant. SAS Web Infrastructure Platform, en versiones anteriores a la 9.4M6, permite que atacantes remotos ejecuten código arbitrario mediante una variante de deserialización de Java. • http://www.securityfocus.com/bid/106648 https://support.sas.com/kb/63/391.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-5454
https://notcve.org/view.php?id=CVE-2014-5454
Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors. Vulnerabilidad de la subida de ficheros sin restricciones en el módulo de la subida de imágenes en SAS Visual Analytics 6.4M1 permite a usuarios remotos autenticados ejecutar código arbitrario mediante la subida de un fichero con una extensión ejecutable, posteriormente accediendo a ello a través de vectores no especificados. • http://packetstormsecurity.com/files/127866/SAS-Visual-Analytics-6.4M1-Arbitrary-File-Upload.html https://exchange.xforce.ibmcloud.com/vulnerabilities/95351 •
CVSS: 9.3EPSS: 8%CPEs: 4EXPL: 0CVE-2014-2262
https://notcve.org/view.php?id=CVE-2014-2262
Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-assisted remote attackers to execute arbitrary code via a crafted SAS program. Desbordamiento de buffer en la aplicación cliente en Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 y TS1M2 y SAS 9.4 TS1M0 permite a atacantes remotos asistidos por usuario ejecutar código arbitrario a través de un programa SAS manipulado. • http://secunia.com/advisories/57029 http://support.sas.com/kb/51/701.html http://www.securityfocus.com/archive/1/531283/100/0/threaded http://www.securityfocus.com/bid/65853 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140227-0_SAS_Buffer_overflow_v10.txt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •