rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-11598 
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:31:55.000Z
CVE-2020-11599 
An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T21:31:39.000Z
CVE-2020-11600 
An issue was discovered on Samsung mobile devices with Q(10.0) software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:11:17.000Z
CVE-2020-11601 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. There is unauthorized access to applications in the Secure Folder via floating icons. The Samsung ID is SVE-2019-16195 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:14:32.000Z
CVE-2020-11602 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Google Assistant leaks clipboard contents on a locked device. The Samsung ID is SVE-2019-16558 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:19:33.000Z
CVE-2020-11603 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. Type confusion in the MLDAP Trustlet allows arbitrary code execution. The Samsung ID is SVE-2020-16599 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:41:55.000Z
CVE-2020-11604 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. There is an Out-of-bounds read in the MLDAP Trustlet. The Samsung ID is SVE-2019-16565 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:27:55.000Z
CVE-2020-11605 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is sensitive information exposure from dumpstate in NFC logs. The Samsung ID is SVE-2019-16359 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:30:04.000Z
CVE-2020-11606 
An issue was discovered on Samsung mobile devices with Q(10.0) software. Information about application preview (in the Secure Folder) leaks on a locked device. The Samsung ID is SVE-2019-16463 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:34:11.000Z
CVE-2020-11607 
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Notification exposure occurs in Lockdown mode because of the Edge Lighting application. The Samsung ID is SVE-2020-16680 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T15:35:41.000Z
CVE-2020-11608 
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:55:08.000Z
CVE-2020-11609 
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T16:05:56.000Z
CVE-2020-11610 
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T17:19:06.000Z
CVE-2020-11611 
An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T17:18:54.000Z
CVE-2020-11612 
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T18:00:34.000Z
CVE-2020-11613 
Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. By default, the Authenticated Users group has Modify permissions to the installation folder. Because of this, any user on the system can replace binaries or plant malicious DLLs to obtain elevated, or different, privileges, depending on the context of the user that runs the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T16:47:05.000Z
CVE-2020-11614 
Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform file integrity validation for files after download. An attacker can perform a man-in-the-middle attack against this connection and replace executable files with malicious versions, which the operating system then executes under the context of the user running Hero Designer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-11T16:49:26.000Z
CVE-2020-11615 
NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure.
Problem types: description: information disclosure
Affected products: vendor: NVIDIA
product: NVIDIA DGX Servers
Published: 2020-10-29T03:35:33.000Z
CVE-2020-11616 
NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information disclosure.
Problem types: description: information disclosure
Affected products: vendor: NVIDIA
product: NVIDIA DGX Servers
Published: 2020-10-29T03:35:33.000Z
CVE-2020-11617 
The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which allows a man-in-the-middle attacker to modify the data delivered to the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:20:55.000Z
CVE-2020-11618 
THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start on boot, which allows an attacker on the local network to achieve root access via the TELNET protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T14:22:17.000Z
CVE-2020-11619 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T22:14:09.000Z
CVE-2020-11620 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T22:14:18.000Z
CVE-2020-11622 
A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368.*, 4.21.4-FCRFX.*, 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1 Router code in a scenario where TCP MSS options are configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-10T19:58:16.000Z
CVE-2020-11623 
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as the camera's bootloader. Successful exploitation could compromise confidentiality, integrity, and availability of the affected system. It could even render the device inoperable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T20:00:21.000Z
CVE-2020-11624 
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there's no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T20:02:05.000Z
CVE-2020-11625 
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI/Security/sessionLogin/capabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T20:03:53.000Z
CVE-2020-11626 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and the Certificate/CRL download servlets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:34:50.000Z
CVE-2020-11627 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery (CSRF) issue has been found in the CA UI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:34:39.000Z
CVE-2020-11628 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols (CMP, ACME, REST, etc.) through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. (EJBCA's internal access control restrictions are still in place, and each respective protocol must be configured to allow for enrollment.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:34:29.000Z
CVE-2020-11629 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to the CA UI could exploit this to upload malicious scripts to the server. (Risks associated with this issue alone are negligible unless a malicious user already has gained access to the CA UI through other means, as a trusted user is already trusted to upload scripts by virtue of having access to the validator.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:34:20.000Z
CVE-2020-11630 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes (connected via the Peers protocol) allows insecure objects to be deserialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:34:10.000Z
CVE-2020-11631 
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T23:33:58.000Z
CVE-2020-11632 
The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-15T19:18:43.000Z
CVE-2020-11633 
The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-15T17:01:13.000Z
CVE-2020-11634 
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-15T19:18:48.000Z
CVE-2020-11635 
The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges.
Problem types: description: Improper Privilege Management
Affected products: vendor: n/a
product: Zscaler Client Connector for Windows
Published: 2021-02-16T19:37:39.000Z
CVE-2020-11637 Automation Runtime TFTP Service DoS Vulnerability
A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.
Problem types: cwe_id: CWE-401
description: CWE-401 Improper Release of Memory Before Removing Last Reference
Affected products: vendor: B&R
product: Automation Runtime
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
version: 3.1
Published: 2020-10-15T15:08:14.438Z
CVE-2020-11639 Insufficient access control on Inter process communication,
An attacker could exploit the vulnerability by
injecting garbage data or specially crafted data. Depending on the data injected each process might be
affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. The attacker could tamper with the data transmitted, causing
the product to store wrong information or act on wrong data or display wrong information.


This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.




For an attack to be successful, the attacker must have local access to a node in the system and be able to
start a specially crafted application that disrupts the communication.
An attacker who successfully exploited the vulnerability would be able to manipulate the data in such
way as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300
and AdvaBuild to crash.
Problem types: cwe_id: CWE-924
description: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected products: vendor: ABB
product: Advant MOD 300 AdvaBuild
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-07-23T17:26:55.489Z
CVE-2020-11640 Elevation of Privilege
AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the
command queue can use it to launch an attack by running any executable on the AdvaBuild node. The
executables that can be run are not limited to AdvaBuild specific executables. 

Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: ABB
product: Advant MOD 300 AdvaBuild
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-07-23T17:36:51.458Z
CVE-2020-11641 SiteManager Local File Inclusion Vulnerability
A local file inclusion vulnerability in B&R SiteManager versions <9.2.620236042 allows authenticated users to read sensitive files from SiteManager instances.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: B&R
product: SiteManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-10-15T14:58:27.058Z
CVE-2020-11642 SiteManager Denial of Service via Local File Inclusion Vulnerability
The local file inclusion vulnerability present in B&R SiteManager versions <9.2.620236042 allows authenticated users to impact availability of SiteManager instances.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: B&R
product: SiteManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2020-10-15T14:58:48.634Z
CVE-2020-11643 GateManager Information Disclosure Vulnerability
An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view information of devices belonging to foreign domains.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: B&R
product: GateManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-10-15T14:57:22.323Z
CVE-2020-11644 GateManager Audit Message Spoofing Vulnerability
The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: B&R
product: GateManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-10-15T14:57:58.788Z
CVE-2020-11645 GateManager Denial of Service Vulnerability
A denial of service vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to limit availability of GateManager instances.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: B&R
product: GateManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-10-15T14:59:08.500Z
CVE-2020-11646 GateManager Log Information Disclosure Vulnerability
A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to view log information reserved for other users.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: B&R
product: GateManager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-10-15T14:59:26.606Z
CVE-2020-11647 
In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. This was addressed in epan/dissectors/packet-bacapp.c by limiting the amount of recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-10T20:16:21.000Z
CVE-2020-11649 
An issue was discovered in GitLab CE and EE 8.15 through 12.9.2. Members of a group could still have access after the group is deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T19:52:15.000Z