sap business one

Name: sap business one
Brand: sap

productUS

cpe:2.3:a:sap:business_one:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

2critical12high17medium0low

updated 2026-10-28

vulnerabilities (31)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-6256US	critical9.6	7.88% (95th)	Exploit	no fix	2017-05-26	= 1.2.3
CVE-2021-38180US	critical9.8	2.05% (81st)	—	no fix	2021-10-12	= 10.0
CVE-2018-2458US	high7.5	1.73% (77th)	—	no fix	2018-09-11	2 versions
CVE-2021-33698US	high8.8	1.10% (65th)	—	no fix	2021-09-15	= 10.0
CVE-2021-33685US	medium6.5	1.03% (64th)	—	no fix	2021-09-14	= 10.0
CVE-2022-31593US	high8.8	1.00% (63rd)	—	no fix	2022-07-12	= 10.0
CVE-2022-32249US	high7.5	0.93% (60th)	—	no fix	2022-07-12	= 10.0
CVE-2018-2410US	medium5.4	0.92% (60th)	—	no fix	2018-04-10	2 versions
CVE-2022-35168US	high7.5	0.87% (59th)	—	no fix	2022-07-12	= 10.0
CVE-2021-37532US	medium4.3	0.81% (57th)	—	no fix	2021-09-14	= 10.0
CVE-2021-33686US	medium5.3	0.80% (56th)	—	no fix	2021-09-14	= 10.0
CVE-2021-38179US	medium4.9	0.80% (56th)	—	no fix	2021-10-12	= 10.0
CVE-2018-2460US	medium5.9	0.77% (55th)	—	no fix	2018-09-11	= 1.2
CVE-2021-33688US	medium4.3	0.65% (51st)	—	no fix	2021-09-14	= 10.0
CVE-2021-33704US	high8.8OT elevated	0.61% (49th)	—	no fix	2021-09-15	= 10.0
CVE-2023-33993US	high7.5	0.58% (47th)	—	no fix	2023-08-08	= 10.0
CVE-2023-37487US	medium5.3	0.50% (43rd)	—	no fix	2023-08-08	= 10.0
CVE-2023-31403US	high8.0OT elevated	0.44% (38th)	—	no fix	2023-11-14	= 10.0
CVE-2021-42066US	medium4.4OT elevated	0.43% (37th)	—	no fix	2021-12-14	= 10.0
CVE-2023-39437US	medium5.4	0.40% (34th)	—	no fix	2023-08-08	= 10.0
CVE-2023-41365US	medium4.3	0.39% (33rd)	—	no fix	2023-10-10	= 10.0
CVE-2018-2425US	medium5.5	0.39% (33rd)	—	no fix	2018-06-12	2 versions
CVE-2019-0256US	medium5.5	0.39% (33rd)	—	no fix	2019-02-15	= 1.2.12
CVE-2020-6239US	medium4.4	0.32% (24th)	—	no fix	2020-06-10	2 versions
CVE-2021-27616US	high7.8OT elevated	0.27% (19th)	—	no fix	2021-05-11	6 versions
CVE-2021-33662US	medium4.4	0.26% (17th)	—	no fix	2021-06-09	= 10.0
CVE-2021-27614US	high7.1	0.26% (17th)	—	no fix	2021-05-11	6 versions
CVE-2021-44234US	medium5.5	0.24% (15th)	—	no fix	2022-01-14	= 10.0
CVE-2022-35292US	high7.8	0.22% (13th)	—	no fix	2022-09-13	= 10.0
CVE-2021-33700US	high7.8OT elevated	0.21% (11th)	—	no fix	2021-09-15	= 10.0
CVE-2026-24319US	medium5.8OT elevated	0.11% (1st)	—	no fix	2026-02-10	= 10.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor7 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-312Cleartext Storage of Sensitive Information2 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-1236Improper Neutralization of Formula Elements in a CSV File1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE31 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan