Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file, it can contain any character, including a leading dash. To exploit this vulnerability, an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be
ed to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as `bundle lock`, inside. This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, the exploitability is very low, because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s befo
fected by this issue. Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them, since they can contain arbitrary ruby code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rubygems/rubygems/security/advisories/GHSA-fj7f-vq84-fh43 - https://github.com/rubygems/rubygems/pull/5142 - https://github.com/rubygems/rubygems/commit/0fad1ccfe9dd7a3c5b82c1496df3c2b4842870d3 - https://github.com/rubygems/rubygems/commit/a4f2f8ac17e6ce81c689527a8b6f14381060d95f - https://www.sonarsource.com/blog/securing-developer-tools-package-managers/
CVE ID: CVE-2021-43810 State: PUBLISHED Published: 2021-12-07T22:00:12 Last Updated: 2024-08-04T04:03:08.738Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Admidio Products: admidio Problem Types: CWE-79 Description: Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12. Additional Analyst Notes: - C
attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh - https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21 - https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b - https://github.com/Admidio/admidio/releases/tag/v4.0.12
CVE ID: CVE-2021-43811 State: PUBLISHED Published: 2021-12-08T23:05:11 Last Updated: 2024-08-04T04:03:08.684Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: awslabs Products: sockeye Problem Types: CWE-94 Description: Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it. If users run the model, the embed
e config file of a trained model and attempt to convince users to download and run it. If users run the model, the embedded code will run locally. The issue is fixed in version 2.3.24. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/awslabs/sockeye/security/advisories/GHSA-ggmr-44cv-24pm - https://github.com/awslabs/sockeye/pull/964 - https://github.com/awslabs/sockeye/releases/tag/2.3.24
CVE ID: CVE-2021-43812 State: PUBLISHED Published: 2021-12-16T18:20:12 Last Updated: 2024-08-04T04:03:08.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: auth0 Products: nextjs-auth0 Problem Types: CWE-601 Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/n
workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-2mqv-4j3r-vjvp - https://github.com/auth0/nextjs-auth0/commit/0bbd9f8a0c93af51f607f28633b5fb18c5e48ad6
CVE ID: CVE-2021-43813 State: PUBLISHED Published: 2021-12-10T17:30:12 Last Updated: 2024-08-04T04:03:09.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: grafana Products: grafana Problem Types: CWE-22 Description: Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 o
y. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q - https://github.com/github/securitylab-vul
- https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q - https://github.com/github/securitylab-vulnerabilities/commit/689fc5d9fd665be4d5bba200a6a433b532172d0f - https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d - https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/ - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-5-12/ - https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-3-2/ - http://www.openwall.com/lists/oss-security/2021/12/10/4 - https://security.netapp.com/advisory/ntap-20220107-0006/
CVE ID: CVE-2021-43814 State: PUBLISHED Published: 2021-12-13T19:35:12 Last Updated: 2024-08-04T04:03:09.036Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: rizinorg Products: rizin Problem Types: CWE-787 Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: R
actions. No workaround are known and users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r - https://github.com/rizinorg/rizin/issues/2083 - https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406
CVE ID: CVE-2021-43815 State: PUBLISHED Published: 2021-12-10T20:40:11 Last Updated: 2024-08-04T04:03:08.839Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: grafana Products: grafana Problem Types: CWE-22 Description: Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been aff
ly allows access to files with the extension .csv to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grafana/grafana/commit/fd48aee61e4328aae8d5303a9efd045fa0ca308d - https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-securit
a9efd045fa0ca308d - https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/ - https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m - https://github.com/grafana/grafana/commit/d6ec6f8ad28f0212e584406730f939105ff6c6d3 - https://github.com/grafana/grafana/releases/tag/v8.3.2 - http://www.openwall.com/lists/oss-security/2021/12/10/4 - https://security.netapp.com/advisory/ntap-20220107-0006/
CVE ID: CVE-2021-43816 State: PUBLISHED Published: 2022-01-05T18:55:10.000Z Last Updated: 2025-04-22T18:34:15.666Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: containerd Products: containerd Problem Types: CWE-281 Description: containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of t
ar file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permissions for savvy containers that would not normally be able to access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade as soon as possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c - https:
DP Vulnrichment: References: - https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c - https://github.com/containerd/containerd/issues/6194 - https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea - https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GD5GH7NMK5VJMA2Y5CYB5O5GTPYMWMLX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPDIZMI7ZPERSZE2XO265UCK5IWM7CID/
CVE ID: CVE-2021-43817 State: PUBLISHED Published: 2021-12-13T19:45:10 Last Updated: 2024-08-04T04:03:08.905Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: CollaboraOnline Products: online Problem Types: CWE-79 Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the sessio
abora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CollaboraOnline/online/security/advisories/GHSA-7f6h-v9mx-58q9
CVE ID: CVE-2021-43818 State: PUBLISHED Published: 2021-12-13T18:05:12 Last Updated: 2024-08-04T04:03:08.992Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: lxml Products: lxml Problem Types: CWE-74, CWE-79 Description: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available. Additional Analyst Notes: - CVE Program Container:
4.6.5 to receive a patch. There are no known workarounds available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8 - https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a - https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776 - https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/ - https://lists.fedoraproject.org/archives/list/package-a
ts.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/ - https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html - https://www.debian.org/security/2022/dsa-5043 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220107-0005/ - htt
https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220107-0005/ - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202208-06
CVE ID: CVE-2021-43819 State: PUBLISHED Published: 2023-04-19T17:05:32.985Z Last Updated: 2025-02-05T14:58:43.676Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: stargate-bukkit Products: Stargate-Bukkit Problem Types: CWE-670 Description: Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items when teleporting through a portal; when they reappear, they will still have their items impacting the integrity of the game world. The teleport code has since been rewritten and is available in release `0.11.5.1`. Users are advised to upgrade. There are no known work
e has since been rewritten and is available in release `0.11.5.1`. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/stargate-bukkit/Stargate-Bukkit/security/advisories/GHSA-64r2-hfr9-849j
CVE ID: CVE-2021-43820 State: PUBLISHED Published: 2021-12-14T18:55:10 Last Updated: 2024-08-04T04:03:09.080Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: haiwen Products: seafile-server Problem Types: CWE-639 Description: Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in
e. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8 - https://github.com/haiwen/seafile-server/pull/520
CVE ID: CVE-2021-43821 State: PUBLISHED Published: 2021-12-14T19:15:12 Last Updated: 2024-08-04T04:03:08.978Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: opencast Products: opencast Problem Types: CWE-552 Description: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local
nd 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating. Additional Analyst Notes: - CVE Program Container
files Opencast needs to read though and we highly recommend updating. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencast/opencast/security/advisories/GHSA-59g4-hpg3-3gcp - https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764 - https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587 - https://mvnrepository.com/artifact/org.opencastproject/opencast-ingest-service-impl
CVE ID: CVE-2021-43822 State: PUBLISHED Published: 2021-12-13T19:50:11 Last Updated: 2024-08-04T04:03:08.861Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: jackalope Products: jackalope-doctrine-dbal Problem Types: CWE-89 Description: Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWa
cape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/G
Notes: - CVE Program Container: References: - https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrm - https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231db
CVE ID: CVE-2021-43823 State: PUBLISHED Published: 2021-12-13T19:55:10 Last Updated: 2024-08-04T04:03:08.900Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: sourcegraph Products: sourcegraph Problem Types: CWE-200 Description: Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specif
require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-cpq7-hmvv-29w9 - https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa
CVE ID: CVE-2021-43824 State: PUBLISHED Published: 2022-02-22T22:15:10.000Z Last Updated: 2025-04-23T19:01:55.018Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: envoyproxy Products: envoy Problem Types: CWE-476 Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
Users are advised to upgrade. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p - https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a