Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-11710 State: PUBLISHED Published: 2020-04-12T16:04:40 Last Updated: 2024-08-04T11:35:13.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1) Inaccurate Bug Scope - The issue scope was on Kong's docker-compose template, and not Kong's docker image itself. In reality, this issue is not associated with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Ko
d with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Kong) through 2.0.3.’ is incorrect. This issue only occurs if a user decided to spin up Kong via docker-compose without following the security documentation. The docker-compose template is meant for users to quickly get started with Kong, and is meant for development purposes only. 2) Incorrect Patch Links - The CVE currently points to a documentation improvement as a “Patch” link: https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to
21b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to protect the admin API were already well-documented here: https://docs.konghq.com/2.0.x/secure-admin-api/#network-layer-access-restrictions , which was first published back in 2017 (as shown in this commit: https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949) Lastly, the hyperlink to https://github.com/Kong/kong (an unrelated Github Repo to this issue) on the Hyperlink list does not include any meaningful information on this topic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kong/kong - https://gith
this topic. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kong/kong - https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611 - https://github.com/Kong/docker-kong/commit/dfa095cadf7e8309155be51982d8720daf32e31c - https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949
CVE ID: CVE-2020-11711 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-10-02T18:12:05.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possible to inject malicious HTML content in order to execute JavaScript inside a victim's browser. This results in a stored XSS on the authentication interface of the admin panel. Moreover, an unsecured authentication form is present on the
red XSS on the authentication interface of the admin panel. Moreover, an unsecured authentication form is present on the authentication interface of the SSL VPN captive portal. Users are allowed to save their credentials inside the browser. If an administrator saves his credentials through this unsecured form, these credentials could be stolen via the stored XSS on the admin panel without user interaction. Another possible exploitation would be modification of the authentication form of the admin panel into a malicious form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.digitemis.com/category/blog/actualite/ - https://twitter.com/_ACKNA
: - CISA ADP Vulnrichment: References: - https://www.digitemis.com/category/blog/actualite/ - https://twitter.com/_ACKNAK_ - https://advisories.stormshield.eu/2020-011/
CVE ID: CVE-2020-11712 State: PUBLISHED Published: 2020-04-12T16:21:42 Last Updated: 2024-08-04T11:35:13.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jenaye/cve/blob/master/readme.MD - https://sourceforge.net/p/openupload/openupload-code/commit_browser - https://sourceforge.net/p/openupload/news/
CVE ID: CVE-2020-11713 State: PUBLISHED Published: 2020-04-12T16:54:24 Last Updated: 2024-08-04T11:35:13.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/pull/2894/ - https://gist.github.com/pietroborrello/7c5be2d1dc15349c4ffc8671f0aad04f
CVE ID: CVE-2020-11714 State: PUBLISHED Published: 2020-04-12T17:32:39 Last Updated: 2024-08-04T11:35:13.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: eten PSG-6528VM 1.1 devices allow XSS via System Contact or System Location. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leona4040/PSG-6528VM-xss/blob/master/README.md
CVE ID: CVE-2020-11715 State: PUBLISHED Published: 2020-05-19T16:07:05 Last Updated: 2024-08-04T11:35:13.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic P99 devices through 2020-04-10 have Incorrect Access Control. NOTE: the vendor states that all affected products are at "End-of-software-support." Additional Analyst Notes: - CVE Program Container: References: - https://mobile.panasonic.com/in/advisory
CVE ID: CVE-2020-11716 State: PUBLISHED Published: 2020-05-20T13:09:01 Last Updated: 2024-08-04T11:35:13.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: the vendor states that all affected products are at "End-of-software-support." Additional Analyst Notes: - CVE Program Container: References: - https://mobile.panasonic.com/in/advisory
CVE ID: CVE-2020-11717 State: PUBLISHED Published: 2020-12-21T20:54:42 Last Updated: 2024-08-04T11:35:13.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://bilanc.com/en/ - http://packetstormsecurity.com/files/160628/Programi-Bilanc-Build-007-Release-014-31.01.2020-SQL-Injection.html - https://seclists.org/fulldisclosure/2020/Dec/36
CVE ID: CVE-2020-11718 State: PUBLISHED Published: 2020-12-23T15:54:35 Last Updated: 2024-08-04T11:35:13.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are downloaded via cleartext HTTP. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Dec/39 - http://packetstormsecurity.com/files/160627/Programi-Bilanc-Build-007-Release-014-31.01.2020-Insecure-Downloads.html
CVE ID: CVE-2020-11719 State: PUBLISHED Published: 2020-12-23T16:02:25 Last Updated: 2024-08-04T11:41:58.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encryption with a weak and guessable static encryption key. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Dec/35 - http://packetstormsecurity.com/files/160625/Programi-Bilanc-Build-007-Release-014-31.01.2020-Static-Key.html
CVE ID: CVE-2020-11720 State: PUBLISHED Published: 2020-12-23T15:58:55 Last Updated: 2024-08-04T11:41:58.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by default with the account admin and password 0000. After the installation, users/admins are not prompted to change this password. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2020/Dec/34 - http://packetstormsecurity.com/files/160623/Programi-Bilanc-Build-007-Release-014-31.01.2020-Weak-Default-Password.html
CVE ID: CVE-2020-11721 State: PUBLISHED Published: 2020-04-12T18:39:18 Last Updated: 2024-08-04T11:42:00.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, which can cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/saitoha/libsixel/issues/134
CVE ID: CVE-2020-11722 State: PUBLISHED Published: 2020-04-12T18:59:46 Last Updated: 2024-08-04T11:41:58.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file. Additional Analyst Notes: - CVE Program Container: References: - https://dpmendenhall.blogspot.com/2020/03/dungeon-crawl-stone-soup.html - https://github.com/crawl/crawl/commit/768f60da87a3fa0b5561da5ade9309577c176d04 - https://github.com/crawl/crawl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg000
wl/commit/fc522ff6eb1bbb85e3de60c60a45762571e48c28 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00037.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNXK7QE7EA7XSDDNOWX2A6MJNWOIYCTC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QLPN635S7J3MUXLIHYK6MDAHEIASFYP/
CVE ID: CVE-2020-11723 State: PUBLISHED Published: 2020-04-14T19:55:00 Last Updated: 2024-08-04T11:41:59.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place evidence onto target devices when performing a forensic extraction. Additional Analyst Notes: - CVE Program Container: References: - https://www.cellebrite.com/en/productupdates/ufed-and-ufed-infield-7-30-provides-new-support-for-smartphones-with-huawei-kirin-processor/ - http://packetstormsecurity.com/files/157217/Cellebrite-UFED-7.29-Hardcoded-ADB-Authentication-Keys.
i-kirin-processor/ - http://packetstormsecurity.com/files/157217/Cellebrite-UFED-7.29-Hardcoded-ADB-Authentication-Keys.html
CVE ID: CVE-2020-11724 State: PUBLISHED Published: 2020-04-12T20:55:26 Last Updated: 2024-08-04T11:41:58.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patch - https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa - https://lists.debian.org/debian-lts-announce
penresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa - https://lists.debian.org/debian-lts-announce/2020/07/msg00014.html - https://www.debian.org/security/2020/dsa-4750 - https://security.netapp.com/advisory/ntap-20210129-0002/
CVE ID: CVE-2020-11725 State: PUBLISHED Published: 2020-04-12T21:25:53 Last Updated: 2024-08-04T11:41:58.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line, which later affects a private_size*count multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding, because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the "owner" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misu
er" concept. The existing callers, SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE, have been designed to misuse the info->owner field in a safe way Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/yabbadabbadrew/status/1248632267028582400 - https://github.com/torvalds/linux/blob/3b2549a3740efb8af0150415737067d87e466c5b/sound/core/control.c#L1434-L1474 - https://lore.kernel.org/alsa-devel/s5h4ktmlfpx.wl-tiwai%40suse.de/
CVE ID: CVE-2020-11727 State: PUBLISHED Published: 2020-05-06T17:27:04 Last Updated: 2024-08-04T11:41:58.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.themissinglink.com.au/security-advisories-cve-2020-11727 - https://wordpress.org/plugins/woo-order-export-lite/#developers - https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-
oo-order-export-lite/#developers - https://plugins.trac.wordpress.org/browser/woo-order-export-lite/trunk/view/settings-form.php - http://packetstormsecurity.com/files/157557/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html
CVE ID: CVE-2020-11728 State: PUBLISHED Published: 2020-04-15T15:37:12 Last Updated: 2024-08-04T11:41:59.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/davical-project/awl/-/issues/19 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650 - https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html - https://www.debian.org/securit
ort.cgi?bug=956650 - https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html - https://www.debian.org/security/2020/dsa-4660 - https://usn.ubuntu.com/4539-1/
CVE ID: CVE-2020-11729 State: PUBLISHED Published: 2020-04-15T15:37:09 Last Updated: 2024-08-04T11:41:58.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Long-term session cookies, uses to provide long-term session continuity, are not generated securely, enabling a brute-force attack that may be successful. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/davical-project/awl/-/issues/18 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650 - https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html - https://www.debian.org/security/2020/dsa-4660
CVE ID: CVE-2020-11731 State: PUBLISHED Published: 2020-04-13T01:02:55 Last Updated: 2024-08-04T11:41:59.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/media-library-assistant/#developers
CVE ID: CVE-2020-11732 State: PUBLISHED Published: 2020-04-13T01:02:19 Last Updated: 2024-08-04T11:41:59.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/media-library-assistant/#developers
CVE ID: CVE-2020-11733 State: PUBLISHED Published: 2020-08-13T13:59:56 Last Updated: 2024-08-04T11:41:58.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Spirent TestCenter and Avalanche appliance admin interface firmware. An attacker, who already has access to an SSH restricted shell, can achieve root access via shell metacharacters. The attacker can then, for example, read sensitive files such as appliance admin configuration source code. This affects Spirent TestCenter and Avalanche products which chassis version <= 5.08. The SSH restricted shell is available with default credentials. Additional Analyst Notes: - CVE Program Container: References:
restricted shell is available with default credentials. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/a05110511t/65d07bc776d7c11b4ccf112a09cca4ab - https://github.com/a05110511t/CVE/blob/master/CVE-2020-11733.md
CVE ID: CVE-2020-11734 State: PUBLISHED Published: 2020-04-13T16:14:44 Last Updated: 2024-08-04T11:41:59.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tonykuo76/d2480727faeb768a97800db3058dceed - https://www.cybersolutions.co.jp/product/cybermail/ - https://www.chtsecurity.com/news/6b907733-c475-4504-b3b7-793442d34335
CVE ID: CVE-2020-11735 State: PUBLISHED Published: 2020-06-25T13:04:41 Last Updated: 2024-08-04T11:41:59.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: The private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular inverse when mapping to affine coordinates, aka a "projective coordinates leak." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/commit/1de07da61f0c8e9926dcbd68119f73230dae283f - https://github.com/wolfSSL/wolfssl/releases/tag/v4.4.0-stable
CVE ID: CVE-2020-11736 State: PUBLISHED Published: 2020-04-13T18:39:26 Last Updated: 2024-08-04T11:41:58.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/file-roller/-/commit/21dfcdbfe258984db89fb65243a1a888924e45a0 - https://lists.debian.org/debian-lts-announce/2020/04/msg00013.html - https://usn.ubuntu.com/4332-1/ - https://usn.ubuntu.com/4332-2/ - https:
org/debian-lts-announce/2020/04/msg00013.html - https://usn.ubuntu.com/4332-1/ - https://usn.ubuntu.com/4332-2/ - https://security.gentoo.org/glsa/202009-06
CVE ID: CVE-2020-11737 State: PUBLISHED Published: 2020-05-05T14:08:15 Last Updated: 2024-08-04T11:41:58.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://blog.zimbr
tes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://blog.zimbra.com/2020/05/new-zimbra-9-kepler-patch-2/ - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P2
CVE ID: CVE-2020-11738 State: PUBLISHED Published: 2020-04-13T21:20:00.000Z Last Updated: 2025-10-21T23:35:46.809Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://snapcreek.com/duplicator/docs/changelog/?lite - https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects
?lite - https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/ - https://cwe.mitre.org/data/definitions/23.html - http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html - http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
CVE ID: CVE-2020-11739 State: PUBLISHED Published: 2020-04-14T12:17:49 Last Updated: 2024-08-04T11:41:59.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executi
ore all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privile
be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-314.html - http://xenbits.xen.org/xsa/advisory-314.html - http://www.openwall.com/lists/oss-security/2020/04/14/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/m
raproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/ - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/ - https://security.gentoo.org/glsa/202005-08 - https://www.debian.org/security/2020/dsa-4723