SAP SE SAP Business One
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-35292 | 10.0 | In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to | HIGH 7.8 | 0.2 % | ||
| CVE-2022-32249 | 10.0 | Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to ga | HIGH 7.5 | 0.9 % | ||
| CVE-2022-35168 | 10.0 | Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rende | HIGH 7.5 | 0.9 % | ||
| CVE-2022-31593 | 10.0 | SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An at | HIGH 8.8 | 1.0 % | ||
| CVE-2021-44234 | < 10.0 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-42066 | < 10.0 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypte | MEDIUM 4.4 | 0.4 % | ||
| CVE-2021-38180 | < 10.0 | SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitati | CRITICAL 9.8 | 2.1 % | ||
| CVE-2021-38179 | < 10.0 | Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents | MEDIUM 4.9 | 0.8 % | ||
| CVE-2021-33704 | < 10.0 | The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be | HIGH 8.8 | 0.6 % | ||
| CVE-2021-33698 | < 10.0 | SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the pr | CRITICAL 9.9 | 1.1 % | ||
| CVE-2021-33700 | < 10.0 | SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the v | HIGH 7.8 | 0.2 % | ||
| CVE-2021-33688 | < 10.0 | SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to fra | MEDIUM 4.3 | 0.7 % | ||
| CVE-2021-33686 | < 10.0 | Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informa | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-33685 | < 10.0 | SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are out | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-37532 | < 10.0 | SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conte | MEDIUM 4.3 | 0.8 % | ||
| CVE-2021-33662 | < 10.0 | Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing | MEDIUM 6.7 | 0.3 % | ||
| CVE-2018-2425 | 9.2 ; 9.3 | Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would other | HIGH 8.4 | 0.4 % | ||
| CVE-2018-2410 | 9.20 ; 9.30 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS | MEDIUM 5.4 | 0.9 % |