SAP SE SAP Business One
18 CVEs affecting SAP SE SAP Business One. Latest disclosed: 2022-09-13. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38180 | Critical | 9.8 | 2021-10-12 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data… |
CVE-2022-31593 | High | 8.8 | 2022-07-12 | SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereb… |
CVE-2021-33704 | High | 8.8 | 2021-09-15 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to speci… |
CVE-2021-33698 | High | 8.8 | 2021-09-15 | SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format va… |
CVE-2018-2425 | High | 8.4 | 2018-06-12 | Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted. |
CVE-2022-35292 | High | 7.8 | 2022-09-13 | In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability kno… |
CVE-2021-33700 | High | 7.8 | 2021-09-15 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowi… |
CVE-2022-35168 | High | 7.5 | 2022-07-12 | Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system tem… |
CVE-2022-32249 | High | 7.5 | 2022-07-12 | Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly… |
CVE-2021-33685 | Medium | 6.5 | 2021-09-14 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restric… |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2018-2410 | Medium | 5.4 | 2018-04-10 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. |
CVE-2021-33686 | Medium | 5.3 | 2021-09-14 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not… |
CVE-2021-38179 | Medium | 4.9 | 2021-10-12 | Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include… |
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-33662 | Medium | 4.4 | 2021-06-09 | Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to acce… |
CVE-2021-37532 | Medium | 4.3 | 2021-09-14 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the… |
CVE-2021-33688 | Medium | 4.3 | 2021-09-14 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions… |