In SAS^® Drug Development, it is possible that malicious Java script could be executed. This is a form of a Java cross-site scripting vulnerability. The user interface is potentially susceptible to these exploits in the following places within the web user interface Dashboard message and notification task setup message:

• Creating a link with no quotation marks: "javascript:prompt()"
• Edit an existing link with, no quotation marks: "javascript:prompt()"

To obtain a fix for this issue, contact SAS Technical Support.

See this link for additional details, as these are widely known vulnerabilities:

Wikipedia: Cross-site scripting

Operating System and Release Information