sas web infrastructure platform vulnerabilities

Latest sas web infrastructure platform CVEs

Newest publication first

1. CVE-2018-20733 BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

   Published 2019-01-17

   High·CVSS 7.5 EPSS 1.1%

   BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

2. CVE-2018-20732 SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

   Published 2019-01-17

   Critical·CVSS 9.8 EPSS 4.0%

   SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

3. CVE-2015-9281 Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.

   Published 2019-01-17

   Medium·CVSS 6.1 EPSS 0.65%

   Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.