rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-13805 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has brute-force attack mishandling because the CAS service lacks a limit on login failures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:40:22.000Z
CVE-2020-13806 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has a use-after-free because of JavaScript execution after a deletion or close operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:47:20.000Z
CVE-2020-13807 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It has circular reference mishandling that causes a loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:48:28.000Z
CVE-2020-13808 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via crafted cross-reference stream data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:53:00.000Z
CVE-2020-13809 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows resource consumption via long strings in the content stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:50:21.000Z
CVE-2020-13810 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows signature validation bypass via a modified file or a file with non-standard signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:55:29.000Z
CVE-2020-13811 
An issue was discovered in Foxit Studio Photo before 3.6.6.922. It has an out-of-bounds write via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:26:09.000Z
CVE-2020-13812 
An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:28:39.000Z
CVE-2020-13813 
An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto366_3.6.6.916.exe is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:33:01.000Z
CVE-2020-13814 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It has a use-after-free via a document that lacks a dictionary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:36:36.000Z
CVE-2020-13815 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7.1. It allows stack consumption via a loop of an indirect object reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:37:14.000Z
CVE-2020-13817 
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T12:31:55.000Z
CVE-2020-13818 
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T12:51:17.000Z
CVE-2020-13819 
Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-05T13:37:16.000Z
CVE-2020-13820 
Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-03T16:22:57.000Z
CVE-2020-13821 
An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker's JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator's account of the Broker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T15:23:46.000Z
CVE-2020-13822 
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:01:53.000Z
CVE-2020-13825 
A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T19:41:02.000Z
CVE-2020-13826 
A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-19T19:39:34.000Z
CVE-2020-13827 
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T14:48:05.000Z
CVE-2020-13828 
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T15:14:03.000Z
CVE-2020-13829 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Attackers can disable the SEAndroid protection mechanism in the RKP. The Samsung ID is SVE-2019-15998 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:09:00.000Z
CVE-2020-13830 
An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:08:21.000Z
CVE-2020-13831 
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 7570 chipsets) software. The Trustonic Kinibi component allows arbitrary memory mapping. The Samsung ID is SVE-2019-16665 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:07:34.000Z
CVE-2020-13832 
An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code execution because of memory disclosure, The Samsung IDs are SVE-2020-17117, SVE-2020-17118, SVE-2020-17119, and SVE-2020-17161 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:06:43.000Z
CVE-2020-13833 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink attack. The Samsung ID is SVE-2020-17183 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:05:59.000Z
CVE-2020-13834 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of Android Debug Bridge (adb) for arbitrary installations. The Samsung ID is SVE-2020-17369 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:05:11.000Z
CVE-2020-13835 
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials. The Samsung ID is SVE-2020-16908 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:04:31.000Z
CVE-2020-13836 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. HWRResProvider allows path traversal for data exposure. The Samsung ID is SVE-2020-16954 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:03:56.000Z
CVE-2020-13837 
An issue was discovered on Samsung mobile devices with Q(10.0) software. The Lockscreen feature does not block Quick Panel access to Music Share. The Samsung ID is SVE-2020-17145 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:03:16.000Z
CVE-2020-13838 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:01:54.000Z
CVE-2020-13839 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T23:24:25.000Z
CVE-2020-13840 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via an MTK AT command handler buffer overflow. The LG ID is LVE-SMP-200008 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T23:24:40.000Z
CVE-2020-13841 
An issue was discovered on LG mobile devices with Android OS 9 and 10 (MTK chipsets). An AT command handler allows attackers to bypass intended access restrictions. The LG ID is LVE-SMP-200009 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T23:24:47.000Z
CVE-2020-13842 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T23:24:58.000Z
CVE-2020-13843 
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T23:25:07.000Z
CVE-2020-13844 
Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-line speculation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T22:46:03.000Z
CVE-2020-13845 
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T17:23:08.000Z
CVE-2020-13846 
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T17:30:09.000Z
CVE-2020-13847 
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T17:16:03.000Z
CVE-2020-13848 
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T19:55:34.000Z
CVE-2020-13849 
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T20:16:26.000Z
CVE-2020-13850 
Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:08:24.000Z
CVE-2020-13851 
Artica Pandora FMS 7.44 allows remote command execution via the events feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:15:13.000Z
CVE-2020-13852 
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:15:04.000Z
CVE-2020-13853 
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:14:53.000Z
CVE-2020-13854 
Artica Pandora FMS 7.44 allows privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:13:21.000Z
CVE-2020-13855 
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T02:13:10.000Z
CVE-2020-13856 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:18:06.000Z
CVE-2020-13857 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They can be rebooted by sending an unauthenticated poof.cgi HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:16:47.000Z
CVE-2020-13858 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:45:44.000Z
CVE-2020-13859 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interface without a password by abusing a forgotten-password feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:27:07.000Z
CVE-2020-13860 
An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T01:33:35.000Z
CVE-2020-13863 
The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T17:57:23.000Z
CVE-2020-13864 
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T21:21:29.000Z
CVE-2020-13865 
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T21:23:37.000Z
CVE-2020-13866 
WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an executable file with a Trojan horse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T15:58:11.000Z
CVE-2020-13867 
Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T17:30:40.000Z
CVE-2020-13868 
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T18:35:06.000Z
CVE-2020-13869 
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T18:34:45.000Z
CVE-2020-13870 
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-05T18:34:35.000Z
CVE-2020-13871 
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-06T15:37:37.000Z
CVE-2020-13872 
Royal TS before 5 has a 0.0.0.0 listener, which makes it easier for attackers to bypass tunnel authentication via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T18:32:59.000Z
CVE-2020-13873 
A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-12T11:42:29.000Z
CVE-2020-13877 
SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-12T20:22:18.000Z
CVE-2020-13878 
IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-05T00:00:00.000Z
CVE-2020-13879 
IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-05T00:00:00.000Z
CVE-2020-13880 
IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-05T00:00:00.000Z
CVE-2020-13881 
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-06T18:18:36.000Z
CVE-2020-13882 
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-18T17:35:35.000Z
CVE-2020-13883 
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-06T18:49:13.000Z
CVE-2020-13884 
Citrix Workspace App before 1912 on Windows has Insecure Permissions and an Unquoted Path vulnerability which allows local users to gain privileges during the uninstallation of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T18:37:26.000Z
CVE-2020-13885 
Citrix Workspace App before 1912 on Windows has Insecure Permissions which allows local users to gain privileges during the uninstallation of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-08T18:24:48.000Z
CVE-2020-13886 
Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-26T16:55:37.000Z
CVE-2020-13887 
documents_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T15:27:42.000Z
CVE-2020-13888 
Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T14:23:16.000Z
CVE-2020-13889 
showAlert() in the administration panel in Bludit 3.12.0 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-06T19:55:01.000Z
CVE-2020-13890 
The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-06T20:02:55.000Z