CVE-2021-37532

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high privileged User.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-375336.5Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commo CVE-2021-375345.4app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.CVE-2021-375359.8SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary auth CVE-2021-375389.8Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to exec CVE-2021-375399.8Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.CVE-2021-37545.3A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This CVE-2021-375406.5In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.CVE-2021-375416.1In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.CVE-2021-375426.1In JetBrains TeamCity before 2020.2.3, XSS was possible.CVE-2021-375438.8In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-375449.8In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.CVE-2021-375457.5In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.