701 matches found
CVE-2024-48735
Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...
PT-2024-33194
Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description The issue concerns an unrestricted file upload in the /SASStudio/SASStudio/sasexec/sessionID/InternalPath endpoint, allowing a remote attacker to upload malicious files. This is disputed by the vendor as file...
CVE-2024-48734
Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...
CVE-2024-48733
SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...
PT-2024-33195 · Sas · Sas Studio
Name of the Vulnerable Software and Affected Versions: SAS Studio version 9.4 Description: The issue allows a remote attacker to access internal files by manipulating the default path during file download through the /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath endpoint, using...
CVE-2024-48734
Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...
CVE-2024-48733
CVE-2024-48733 describes a SQL injection vulnerability in SAS Studio 9.4 at the endpoint /SASStudio/sasexec/sessions/{sessionID}/sql. The issue allows a remote attacker to execute arbitrary SQL commands by sending data in the POST body, with high impact on confidentiality, integrity, and availabi...
CVE-2024-48734
Unrestricted file upload exists in SAS Studio 9.4 at the endpoint /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath}, enabling a remote attacker to upload malicious files. The vulnerability is disputed by the vendor, who notes that file upload is allowed for authorized users. Affected produc...
CVE-2024-48735
CVE-2024-48735 : In SAS Studio 9.4, a Directory Traversal vulnerability exists in the /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} endpoint. A remote attacker could access internal files by manipulating the default path during file download. The vendor disputes the flaw, argui...
The Snowflake Connector for Python stores sensitive data in logs
Issue Snowflake recently learned about and remediated a set of vulnerabilities in the Snowflake Connector for Python. Under specific conditions, certain users credentials or portions of those credentials were logged locally by the Connector to the users own systems. The credentials were not logge...
CVE-2024-49750
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...
CVE-2024-49750 Snowflake Connector for Python has sensitive data in logs
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes when specified...
PT-2024-36895
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the scsi: hisi sas driver. The issue occurs when the dump is triggered while the driver is unbind, causing a hang due to ...
CVE-2024-46937
The CVE-2024-46937 entry concerns MFASOFT Secure Authentication Server (SAS) 1.8.x–1.9.x prior to 1.9.040924, where an improper access control (IDOR) allows remote attackers to access user tokens without authentication via the /api-selfportal/get-info-token-properties endpoint. The root cause is ...
SUSE CVE-2024-42159
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise numphys Information is stored in mrsasport-phymask, values larger then size of this field shouldn't be allowed...
DEBIAN-CVE-2024-42159
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise numphys Information is stored in mrsasport-phymask, values larger then size of this field shouldn't be allowed...
UBUNTU-CVE-2024-42159
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise numphys Information is stored in mrsasport-phymask, values larger then size of this field shouldn't be allowed...
KernelCI SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on KernelCI. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to make unauthorized changes to...