# Vulnerabilities published in 2021


- [CVE-2021-22860](https://insights.sbomify.com/CVE-2021-22860/): EIC e-document system - Broken Authentication (critical 9.8)
- [CVE-2021-2286](https://insights.sbomify.com/CVE-2021-2286/): Other in VM VirtualBox (high 7.1)
- [CVE-2021-22859](https://insights.sbomify.com/CVE-2021-22859/): EIC e-document system - SQL Injection (critical 9.8)
- [CVE-2021-22858](https://insights.sbomify.com/CVE-2021-22858/): ChanGate EnterPrise Co., Ltd property management system - Broken Authentication (high 8.8)
- [CVE-2021-22857](https://insights.sbomify.com/CVE-2021-22857/): ChanGate EnterPrise Co., Ltd property management system - Directory Traversal (high 7.5)
- [CVE-2021-22856](https://insights.sbomify.com/CVE-2021-22856/): ChanGate EnterPrise Co., Ltd property management system - SQL Injection (critical 9.8)
- [CVE-2021-22855](https://insights.sbomify.com/CVE-2021-22855/): Soar Cloud System Co., Ltd. HR Portal - Arbitrary Code Execution (critical 9.8)
- [CVE-2021-22854](https://insights.sbomify.com/CVE-2021-22854/): Soar Cloud System Co., Ltd. HR Portal - SQL Injection (high 7.5)
- [CVE-2021-22853](https://insights.sbomify.com/CVE-2021-22853/): Soar Cloud System Co., Ltd. HR Portal - Broken Access Control (medium 5.4)
- [CVE-2021-22852](https://insights.sbomify.com/CVE-2021-22852/): HGiga OAKloud Portal - SQL injection -2 (high 8.8)
- [CVE-2021-22851](https://insights.sbomify.com/CVE-2021-22851/): HGiga OAKloud Portal - SQL injection -1 (critical 9.8)
- [CVE-2021-22850](https://insights.sbomify.com/CVE-2021-22850/): HGiga OAKloud Portal - Security Misconfiguration (medium 5.3)
- [CVE-2021-2285](https://insights.sbomify.com/CVE-2021-2285/): Information disclosure in VM VirtualBox (high 7.1)
- [CVE-2021-22849](https://insights.sbomify.com/CVE-2021-22849/): Hyweb HyCMS-J1 - Stored XSS (medium 4.6)
- [CVE-2021-22848](https://insights.sbomify.com/CVE-2021-22848/): HGiga MailSherlock - SQL Injection-2 (high 7.0)
- [CVE-2021-22847](https://insights.sbomify.com/CVE-2021-22847/): Hyweb HyCMS-J1 - SQL Injection (high 8.8)
- [CVE-2021-2284](https://insights.sbomify.com/CVE-2021-2284/): Other in VM VirtualBox (high 7.1)
- [CVE-2021-2283](https://insights.sbomify.com/CVE-2021-2283/): Information disclosure in VM VirtualBox (high 7.1)
- [CVE-2021-22827](https://insights.sbomify.com/CVE-2021-22827/): Cross-site scripting in schneider-electric:ecostruxure power monitoring expert (high 8.8)
- [CVE-2021-22826](https://insights.sbomify.com/CVE-2021-22826/): Cross-site scripting in schneider-electric:ecostruxure power monitoring expert (high 8.8)
- [CVE-2021-22825](https://insights.sbomify.com/CVE-2021-22825/): Information disclosure in schneider-electric:rack power distribution unit with network management card 2 firmware (high 8.0)
- [CVE-2021-22824](https://insights.sbomify.com/CVE-2021-22824/): Memory corruption in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior) (high 7.5)
- [CVE-2021-22823](https://insights.sbomify.com/CVE-2021-22823/): Missing authorization in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21320 and prior) (critical 9.1)
- [CVE-2021-22822](https://insights.sbomify.com/CVE-2021-22822/): Cross-site scripting in schneider-electric:evlink city evc1s22p4 firmware (medium 6.1)
- [CVE-2021-22821](https://insights.sbomify.com/CVE-2021-22821/): Server-side request forgery in schneider-electric:evlink city evc1s22p4 firmware (high 8.6)
- [CVE-2021-22820](https://insights.sbomify.com/CVE-2021-22820/): Auth bypass in schneider-electric:evlink city evc1s22p4 firmware (critical 9.8)
- [CVE-2021-2282](https://insights.sbomify.com/CVE-2021-2282/): Information disclosure in VM VirtualBox (high 7.1)
- [CVE-2021-22819](https://insights.sbomify.com/CVE-2021-22819/): Other in schneider-electric:evlink city evc1s22p4 firmware (medium 4.3)
- [CVE-2021-22818](https://insights.sbomify.com/CVE-2021-22818/): Auth bypass in schneider-electric:evlink city evc1s22p4 firmware (high 7.5)
- [CVE-2021-22817](https://insights.sbomify.com/CVE-2021-22817/): Misconfiguration in Harmony/Magelis iPC Series (All Versions), Vijeo Designer (All Versions prior to V6.2 SP11 Multiple HotFix 4), Vijeo Designer Basic (All Versions prior to V1.2.1) (high 7.8)
- [CVE-2021-22816](https://insights.sbomify.com/CVE-2021-22816/): Denial of service in schneider-electric:scadapack 312e firmware (high 7.5)
- [CVE-2021-22815](https://insights.sbomify.com/CVE-2021-22815/): Information disclosure in schneider-electric:network management card 2 firmware (medium 5.3)
- [CVE-2021-22814](https://insights.sbomify.com/CVE-2021-22814/): Cross-site scripting in schneider-electric:network management card 2 firmware (medium 6.1)
- [CVE-2021-22813](https://insights.sbomify.com/CVE-2021-22813/): Cross-site scripting in schneider-electric:network management card 2 firmware (medium 6.1)
- [CVE-2021-22812](https://insights.sbomify.com/CVE-2021-22812/): Cross-site scripting in schneider-electric:network management card 2 firmware (medium 6.1)
- [CVE-2021-22811](https://insights.sbomify.com/CVE-2021-22811/): Cross-site scripting in schneider-electric:network management card 2 firmware (medium 6.1)
- [CVE-2021-22810](https://insights.sbomify.com/CVE-2021-22810/): Cross-site scripting in schneider-electric:network management card 2 firmware (medium 6.1)
- [CVE-2021-2281](https://insights.sbomify.com/CVE-2021-2281/): Other in VM VirtualBox (high 7.1)
- [CVE-2021-22809](https://insights.sbomify.com/CVE-2021-22809/): Memory corruption in schneider-electric:guicon (medium 5.5)
- [CVE-2021-22808](https://insights.sbomify.com/CVE-2021-22808/): Use after free in schneider-electric:guicon (high 7.8)
- [CVE-2021-22807](https://insights.sbomify.com/CVE-2021-22807/): Memory corruption in schneider-electric:guicon (high 7.8)
- [CVE-2021-22806](https://insights.sbomify.com/CVE-2021-22806/): Information disclosure in spaceLYnk (V2.6.1 and prior), Wiser for KNX (V2.6.1 and prior), fellerLYnk (V2.6.1 and prior) (high 7.5)
- [CVE-2021-22805](https://insights.sbomify.com/CVE-2021-22805/): Missing authorization in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) (critical 9.1)
- [CVE-2021-22804](https://insights.sbomify.com/CVE-2021-22804/): Path traversal in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) (high 7.5)
- [CVE-2021-22803](https://insights.sbomify.com/CVE-2021-22803/): File upload in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) (critical 9.8)
- [CVE-2021-22802](https://insights.sbomify.com/CVE-2021-22802/): Memory corruption in Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior) (critical 9.8)
- [CVE-2021-22801](https://insights.sbomify.com/CVE-2021-22801/): Privilege escalation in ConneXium Network Manager Software (All Versions) (critical 9.8)
- [CVE-2021-22800](https://insights.sbomify.com/CVE-2021-22800/): Denial of service in Modicon M218 Logic Controller (V5.1.0.6 and prior) (high 7.5)
- [CVE-2021-2280](https://insights.sbomify.com/CVE-2021-2280/): Information disclosure in VM VirtualBox (high 7.1)
- [CVE-2021-22799](https://insights.sbomify.com/CVE-2021-22799/): Weak cryptography in schneider-electric:software update (low 3.8)
- [CVE-2021-22798](https://insights.sbomify.com/CVE-2021-22798/): Information disclosure in Conext� ComBox (All Versions) (high 7.5)
- [CVE-2021-22797](https://insights.sbomify.com/CVE-2021-22797/): Path traversal in EcoStruxure Control Expert (high 7.8)
- [CVE-2021-22796](https://insights.sbomify.com/CVE-2021-22796/): Auth bypass in C-Bus Toolkit (V1.15.9 and prior), C-Gate Server (V2.11.7 and prior) (high 7.8)
- [CVE-2021-22795](https://insights.sbomify.com/CVE-2021-22795/): Command injection in StruxureWare Data Center Expert (critical 9.1)
- [CVE-2021-22794](https://insights.sbomify.com/CVE-2021-22794/): Path traversal in StruxureWare Data Center Expert (critical 9.1)
- [CVE-2021-22793](https://insights.sbomify.com/CVE-2021-22793/): Information disclosure in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn (Versions prior to V2.2.4) (high 7.2)
- [CVE-2021-22792](https://insights.sbomify.com/CVE-2021-22792/): Null dereference in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions) (medium 6.5)
- [CVE-2021-22791](https://insights.sbomify.com/CVE-2021-22791/): Memory corruption in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions) (medium 6.5)
- [CVE-2021-22790](https://insights.sbomify.com/CVE-2021-22790/): Memory corruption in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions) (medium 6.5)
- [CVE-2021-2279](https://insights.sbomify.com/CVE-2021-2279/): Other in VM VirtualBox (high 8.1)
- [CVE-2021-22789](https://insights.sbomify.com/CVE-2021-22789/): Memory corruption in Modicon M580 CPU (part numbers BMEP* and BMEH*, all versions), Modicon M340 CPU (part numbers BMXP34*, all versions), Modicon MC80 (part numbers BMKC80*, all versions), Modicon Momentum Ethernet CPU (part numbers 171CBU*, all versions), PLC Simulator for EcoStruxureª Control Expert, including all Unity Pro versions (former name of EcoStruxureª Control Expert, all versions), PLC Simulator for EcoStruxureª Process Expert including all HDCS versions (former name of EcoStruxureª Process Expert, all versions), Modicon Quantum CPU (part numbers 140CPU*, all versions), Modicon Premium CPU (part numbers TSXP5*, all versions) (medium 6.5)
- [CVE-2021-22788](https://insights.sbomify.com/CVE-2021-22788/): Memory corruption in Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) (high 7.5)
- [CVE-2021-22787](https://insights.sbomify.com/CVE-2021-22787/): Denial of service in Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) (high 7.5)
- [CVE-2021-22786](https://insights.sbomify.com/CVE-2021-22786/): Information disclosure in Legacy Modicon Quantum (high 7.5)
- [CVE-2021-22785](https://insights.sbomify.com/CVE-2021-22785/): Information disclosure in Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions) (high 7.5)
- [CVE-2021-22784](https://insights.sbomify.com/CVE-2021-22784/): Auth bypass in C-Bus Toolkit v1.15.8 and prior (medium 5.7)
- [CVE-2021-22783](https://insights.sbomify.com/CVE-2021-22783/): Information disclosure in Ritto Wiser Door (high 8.8)
- [CVE-2021-22782](https://insights.sbomify.com/CVE-2021-22782/): Information disclosure in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions (medium 5.5)
- [CVE-2021-22781](https://insights.sbomify.com/CVE-2021-22781/): Information disclosure in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions (medium 5.5)
- [CVE-2021-22780](https://insights.sbomify.com/CVE-2021-22780/): Security feature bypass in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions (high 7.1)
- [CVE-2021-2278](https://insights.sbomify.com/CVE-2021-2278/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-22779](https://insights.sbomify.com/CVE-2021-22779/): Auth bypass in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*) (medium 6.5)
- [CVE-2021-22778](https://insights.sbomify.com/CVE-2021-22778/): Information disclosure in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), and SCADAPack RemoteConnect for x70, all versions (high 7.1)
- [CVE-2021-22777](https://insights.sbomify.com/CVE-2021-22777/): Deserialization in SoSafe Configurable prior to V1.8.1 (high 7.8)
- [CVE-2021-22775](https://insights.sbomify.com/CVE-2021-22775/): Privilege escalation in GP-Pro EX V4.09.250 and prior (high 7.8)
- [CVE-2021-22774](https://insights.sbomify.com/CVE-2021-22774/): Weak cryptography in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) (high 7.5)
- [CVE-2021-22773](https://insights.sbomify.com/CVE-2021-22773/): Auth bypass in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) (medium 6.5)
- [CVE-2021-22772](https://insights.sbomify.com/CVE-2021-22772/): Auth bypass in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104) SC2-04IEC-07000100 and earlier), and Easergy T200 ((DNP3) SC2-04DNP-07000102 and earlier) (critical 9.8)
- [CVE-2021-22771](https://insights.sbomify.com/CVE-2021-22771/): Code injection in Easergy T300 with firmware V2.7.1 and older (high 7.3)
- [CVE-2021-22770](https://insights.sbomify.com/CVE-2021-22770/): Information disclosure in Easergy T300 with firmware V2.7.1 and older (medium 6.5)
- [CVE-2021-2277](https://insights.sbomify.com/CVE-2021-2277/): Information disclosure in Coherence (high 7.5)
- [CVE-2021-22769](https://insights.sbomify.com/CVE-2021-22769/): Information disclosure in Easergy T300 with firmware V2.7.1 and older (medium 5.3)
- [CVE-2021-22768](https://insights.sbomify.com/CVE-2021-22768/): Other in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) (critical 9.8)
- [CVE-2021-22767](https://insights.sbomify.com/CVE-2021-22767/): Other in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) (critical 9.8)
- [CVE-2021-22766](https://insights.sbomify.com/CVE-2021-22766/): Denial of service in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) (high 7.5)
- [CVE-2021-22765](https://insights.sbomify.com/CVE-2021-22765/): Other in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) (critical 9.8)
- [CVE-2021-22764](https://insights.sbomify.com/CVE-2021-22764/): Auth bypass in PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation) (medium 5.3)
- [CVE-2021-22763](https://insights.sbomify.com/CVE-2021-22763/): Auth bypass in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) (critical 9.8)
- [CVE-2021-22762](https://insights.sbomify.com/CVE-2021-22762/): Path traversal in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22761](https://insights.sbomify.com/CVE-2021-22761/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22760](https://insights.sbomify.com/CVE-2021-22760/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-2276](https://insights.sbomify.com/CVE-2021-2276/): Other in iSetup (high 8.1)
- [CVE-2021-22759](https://insights.sbomify.com/CVE-2021-22759/): Use after free in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22758](https://insights.sbomify.com/CVE-2021-22758/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22757](https://insights.sbomify.com/CVE-2021-22757/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22756](https://insights.sbomify.com/CVE-2021-22756/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22755](https://insights.sbomify.com/CVE-2021-22755/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22754](https://insights.sbomify.com/CVE-2021-22754/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22753](https://insights.sbomify.com/CVE-2021-22753/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)
- [CVE-2021-22752](https://insights.sbomify.com/CVE-2021-22752/): Memory corruption in IGSS Definition (Def.exe) V15.0.0.21140 and prior (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/225/