BO
Product
Business One
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 12Medium 17Low 0
Watch
Add Business One to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33685 | 6.5 | Sep 14 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory Affected: 10.0 |
| CVE-2018-2460 | 5.9 | Sep 11 | SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection Affected: 1.2 |
| CVE-2026-24319 | 5.8 | Feb 10 | Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) Affected: 10.0; 10.0 |
| CVE-2021-44234 | 5.5 | Jan 14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information Affected: 10.0 |
| CVE-2019-0256 | 5.5 | Feb 15 | Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted Affected: 1.2.12 |
| CVE-2018-2425 | 5.5 | Jun 12 | Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted Affected: 9.2; 9.3 |
| CVE-2023-39437 | 5.4 | Aug 8 | SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to… Affected: 10.0 |
| CVE-2018-2410 | 5.4 | Apr 10 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability Affected: 9.2; 9.3 |
| CVE-2023-37487 | 5.3 | Aug 8 | SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which… Affected: 10.0 |
| CVE-2021-33686 | 5.3 | Sep 14 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over… Affected: 10.0 |
| CVE-2021-38179 | 4.9 | Oct 12 | Debug function of Admin UI of SAP Business One Integration is enabled by default Affected: 10.0 |
| CVE-2021-42066 | 4.4 | Dec 14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted Affected: 10.0 |
| CVE-2021-33662 | 4.4 | Jun 9 | Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which… Affected: 10.0 |
| CVE-2020-6239 | 4.4 | Jun 10 | Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to… Affected: 9.3; 10.0 |
| CVE-2023-41365 | 4.3 | Oct 10 | SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to… Affected: 10.0 |
| CVE-2021-37532 | 4.3 | Sep 14 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which… Affected: 10.0 |
| CVE-2021-33688 | 4.3 | Sep 14 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database Affected: 10.0 |
Showing 17