Business One vulnerabilitiesRanked by how likely they are to be used.
Business One is made by SAP. We track 30 published vulnerabilities listed under that exact name, across 9 versions. None of them is on the list of flaws known to be exploited today. SAP lists newer releases under their own names, such as Business One 2005-a, so check those pages too.
We keep watching the known-exploited list.
Is Business One listed under other names? Yes.
SAP also lists Business One under more specific names, such as Business One 2005-a and Business One Client. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Business One vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Business One's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Business One flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 7.9%CVE-2016-6256Critical
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to...
- 2.1%CVE-2021-38180Critical
SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitation during the data export.
- 1.7%CVE-2018-2458High
Under certain conditions, Crystal Report using SAP Business One, versions 9.2 and 9.3, connection type allows an attacker to access information which would otherwise be restricted.
- 1.1%CVE-2021-33698High
SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the proper file format validation.
- 1.0%CVE-2021-33685Medium
SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outside of the restricted directory.
- 1.0%CVE-2022-31593High
SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application.
- 0.9%CVE-2022-32249High
Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly sensitive information (e.g., high privileged account...
- 0.9%CVE-2018-2410Medium
SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability.
- 0.9%CVE-2022-35168High
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
- 0.8%CVE-2021-37532Medium
SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high...
Running Business One? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.
- Matched to
- Business One on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 30 published vulnerabilities listed under the name Business One, across 9 versions.
None of Business One's vulnerabilities is on the list of flaws known to be exploited today.
SAP also lists Business One under more specific names, such as Business One 2005-a and Business One Client. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Business One. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.