CVE-2023-31403Critical 9.6Improper Access Control vulnerability in SAP Business One product installation0.4%
CVE-2023-39437High 7.6Cross-Site Scripting (XSS) vulnerability in SAP Business One0.4%
CVE-2022-35292UnratedIn SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows 0.2%
CVE-2022-32249UnratedUnder special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly sensitive information (e.g., high privil0.9%
CVE-2022-35168UnratedDue to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.0.9%
CVE-2022-31593UnratedSAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application1.0%
CVE-2021-44234UnratedSAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.0.2%
CVE-2021-42066UnratedSAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth 0.4%
CVE-2021-38180UnratedSAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export. An attacker could thereby execute2.1%
CVE-2021-38179UnratedDebug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.0.8%
CVE-2021-33704Medium 6.3The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be restricted to specific users. For an attacker to discover th0.6%
CVE-2021-33698Critical 9.9SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation.1.1%
CVE-2021-33700High 7.0SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the victim without knowing his/her password. The attacker could s0.2%
CVE-2021-33688UnratedSAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained.0.7%
CVE-2021-33686Medium 5.3Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree.0.8%
CVE-2021-33685Medium 6.5SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory. A successful attack allows1.0%
CVE-2021-37532Medium 4.3SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be rest0.8%
CVE-2021-33662Medium 6.7Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be r0.3%