Sap Business One vulnerabilities

CVE-2018-2425 [MEDIUM] CVE-2018-2425: Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.

CVE-2019-0256 [MEDIUM] CVE-2019-0256: Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to Under certain conditions SAP Business One Mobile Android App, version 1.2.12, allows an attacker to access information which would otherwise be restricted.

CVE-2021-38179 [MEDIUM] CVE-2021-38179: Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin Debug function of Admin UI of SAP Business One Integration is enabled by default. This allows Admin User to see the captured packet contents which may include User credentials.

CVE-2018-2410 [MEDIUM] CWE-79 CVE-2018-2410: SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, whic SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.

CVE-2021-37532 [MEDIUM] CWE-22 CVE-2021-37532: SAP Business One version - 10, due to improper input validation, allows an authenticated User to gai SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high privileged User.

CVE-2021-33688 [MEDIUM] CWE-89 CVE-2021-33688: SAP Business One allows an attacker with business privileges to execute crafted database queries, ex SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained.

CVE-2021-44234 [MEDIUM] CWE-532 CVE-2021-44234: SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature a SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

CVE-2021-42066 [MEDIUM] CWE-312 CVE-2021-42066: SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the net SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker to discover vulnerable function in-depth application knowledge is required, but once exploited the attacker may be able to completely compromise confidentiality, integrity, and availability of

CVE-2023-41365 [MEDIUM] CWE-611 CVE-2023-41365: SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack t SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.

CVE-2020-6239 [MEDIUM] CWE-522 CVE-2020-6239: Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker w Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM user password in clear text, leading to Information Disclosure.

CVE-2021-33662 [MEDIUM] CVE-2021-33662: Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive Under certain conditions, the installation of SAP Business One, version - 10.0, discloses sensitive information on the file system allowing an attacker to access information which would otherwise be restricted.