rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8478 ABB System 800xA Inter process communication vulnerability
Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl (all published versions) enables an attacker authenticated on the local system to inject data, affecting the online view of runtime data shown in Control Builder.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: OPC Server for AC 800M
vendor: ABB
product: MMS Server for AC 800M
vendor: ABB
product: Base Software for SoftControl
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2020-04-29T01:58:54.000Z
CVE-2020-8479 ABB Central Licensing System - XML External Entity Injection
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5. an XML External Entity Injection vulnerability exists that allows an attacker to read or call arbitrary files from the license server and/or from the network and also block the license handling.
Problem types: cwe_id: CWE-91
description: CWE-91 XML Injection (aka Blind XPath Injection)
Affected products: vendor: ABB
product: Central Licensing System
vendor: ABB
product: ABB Ability System 800xA
vendor: ABB
product: Compact HMI
vendor: ABB
product: Control Builder Safe
vendor: ABB
product: Symphony Plus S+ Operations
vendor: ABB
product: Symphony Plus S+ Engineering
vendor: ABB
product: Composer Harmony
vendor: ABB
product: Composer Melody
vendor: ABB
product: Harmony OPC Server Standalone
vendor: ABB
product: Advant OCS Control Builder A
vendor: ABB
product: Composer CTK
vendor: ABB
product: AdvaBuild
vendor: ABB
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
product: OPC Data Link
vendor: ABB
product: Knowledge Manager
vendor: ABB
product: Manufacturing Operations Management
vendor: ABB
product: Advant  OCS AC 100 OPS Server
vendor: ABB
product: ABB  Ability™ SCADAvantage
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
Published: 2020-04-29T00:00:00.000Z
CVE-2020-8481 ABB Central Licensing System - Information disclosure
For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: ABB
product: Central Licensing System
vendor: ABB
product: ABB Ability System 800xA
vendor: ABB
product: Compact HMI
vendor: ABB
product: Control Builder Safe
vendor: ABB
product: Symphony Plus S+ Operations
vendor: ABB
product: Symphony Plus S+ Engineering
vendor: ABB
product: Composer Harmony
vendor: ABB
product: Composer Melody
vendor: ABB
product: Harmony OPC Server Standalone
vendor: ABB
product: Advant OCS Control Builder A
vendor: ABB
product: Composer CTK
vendor: ABB
product: AdvaBuild
vendor: ABB
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
product: OPC Data Link
vendor: ABB
product: Knowledge Manager
vendor: ABB
product: Manufacturing Operations Management
vendor: ABB
product: Advant  OCS AC 100 OPS Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:30:56.000Z
CVE-2020-8482 ABB Device Library Wizard Information Disclosure Vulnerability
Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data
Problem types: cwe_id: CWE-922
description: CWE-922: Insecure Storage of Sensitive Information
Affected products: vendor: ABB
product: ABB Device Library Wizard
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-05-29T21:33:10.000Z
CVE-2020-8484 ABB System 800xA Inter process communication vulnerability - 800xA for DCI
Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: 800xA for DCI
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:58:57.000Z
CVE-2020-8485 ABB System 800xA Inter process communication vulnerability - 800xA for Mod 300
Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: 800xA for MOD300
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:59:04.000Z
CVE-2020-8486 ABB System 800xA Inter process communication vulnerability - 800xA RNRP
Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: 800xA RNRP
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2020-04-29T01:59:23.000Z
CVE-2020-8487 ABB System 800xA Inter process communication vulnerability - System 800xA Base
Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the local system to inject data, affect node redundancy handling.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: System 800xA Base
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
Published: 2020-04-29T01:59:28.000Z
CVE-2020-8488 ABB System 800xA Inter process communication vulnerability - 800xA Batch Management
Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: 800xA Batch Management
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:59:34.000Z
CVE-2020-8489 ABB System 800xA Inter process communication vulnerability - 800xA Information Management
Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management history services unavailable.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: ABB
product: 800xA Information Management
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:59:42.000Z
CVE-2020-8492 
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:00:00.000Z
CVE-2020-8493 
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T21:18:31.000Z
CVE-2020-8494 
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the emp_id, userid, pw1, pw2, supervisor, and timekeeper parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T21:18:23.000Z
CVE-2020-8495 
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and delegatorUserId parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T21:18:15.000Z
CVE-2020-8496 
In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T21:17:59.000Z
CVE-2020-8497 
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T15:01:08.000Z
CVE-2020-8498 
XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T22:52:15.000Z
CVE-2020-8500 
In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T15:03:22.000Z
CVE-2020-8503 
Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by an authenticated sender because of an error in a file-upload feature. This is fixed in 5.1.1068 and 6.0.1004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T19:57:55.000Z
CVE-2020-8504 
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T21:27:54.000Z
CVE-2020-8505 
School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T21:27:43.000Z
CVE-2020-8506 
The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:19:49.000Z
CVE-2020-8507 
The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:15:09.000Z
CVE-2020-8508 
nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T02:43:06.000Z
CVE-2020-8509 
Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T17:50:16.000Z
CVE-2020-8510 
An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T15:00:40.000Z
CVE-2020-8511 
In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T15:12:00.000Z
CVE-2020-8512 
In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T23:05:29.000Z
CVE-2020-8514 
An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-02T14:06:20.000Z
CVE-2020-8515 
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-01T12:36:59.000Z
CVE-2020-8516 
The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-02T12:52:56.000Z
CVE-2020-8517 
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T19:54:31.000Z
CVE-2020-8518 
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T14:53:34.000Z
CVE-2020-8519 
SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Problem types: description: SQL Injection
Affected products: vendor: phpzag
product: phpzag live add edit delete data tables records with ajax php mysql
Published: 2020-07-07T19:20:20.000Z
CVE-2020-8520 
SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Problem types: description: SQL Injection in search field of phpzag live add edit delete data tables records with ajax php mysql
Affected products: vendor: phpzag
product: phpzag live add edit delete data tables records with ajax php mysql
Published: 2020-07-07T19:20:20.000Z
CVE-2020-8521 
SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql
Problem types: description: SQL Injection in search field of phpzag live add edit delete data tables records with ajax php mysql
Affected products: vendor: phpzag
product: phpzag live add edit delete data tables records with ajax php mysql
Published: 2020-07-07T19:20:21.000Z
CVE-2020-8539 
Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-01T17:48:46.000Z
CVE-2020-8540 
An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-11T16:15:47.000Z
CVE-2020-8541 
OX App Suite through 7.10.3 allows XXE attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T13:47:27.000Z
CVE-2020-8542 
OX App Suite through 7.10.3 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T13:46:57.000Z
CVE-2020-8543 
OX App Suite through 7.10.3 has Improper Input Validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T13:46:10.000Z
CVE-2020-8544 
OX App Suite through 7.10.3 allows SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-16T13:50:52.000Z
CVE-2020-8545 
Global.py in AIL framework 2.8 allows path traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T15:23:17.000Z
CVE-2020-8547 
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T15:52:13.000Z
CVE-2020-8548 
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T16:32:35.000Z
CVE-2020-8549 
Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T16:43:03.000Z
CVE-2020-8551 Kubernetes kubelet denial of service
The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
Problem types: cwe_id: CWE-789
description: CWE-789 Uncontrolled Memory Allocation
Affected products: vendor: Kubernetes
product: Kubernetes
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Henrik Schmidt
Published: 2020-03-27T14:25:14.000Z