Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `DISALLOW_FILE_MODS` constant is set to `true` are not affected. Sites where an administrative user either does not need to enter FTP credentials or they have access to the valid FTP credentials, are not affected. The issue was fixed in WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will n
4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will not be possible for any user to upload a plugin and therefore this issue will not be exploitable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r
CVE ID: CVE-2024-31211 State: PUBLISHED Published: 2024-04-04T23:00:17.782Z Last Updated: 2024-08-02T01:46:04.743Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-502 Description: WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/adv
ISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m257-q4m5-j653
CVE ID: CVE-2024-31212 State: PUBLISHED Published: 2024-04-04T23:02:38.775Z Last Updated: 2024-08-02T01:46:04.773Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: instantsoft Products: icms2 Problem Types: CWE-89, CWE-20 Description: InstantCMS is a free and open source content management system. A SQL injection vulnerability affects instantcms v2.16.2 in which an attacker with administrative privileges can cause the application to execute unauthorized SQL code. The vulnerability exists in index_chart_data action, which receives an input from user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statem
om user and passes it unsanitized to the core model `filterFunc` function that further embeds this data in an SQL statement. This allows attackers to inject unwanted SQL code into the statement. The `period` should be escaped before inserting it in the query. As of time of publication, a patched version is not available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/instantsoft/icms2/security/advisories/GHSA-qx95-w566-73fw - https://github.com/instantsoft/icms2/blob/4691a1524780e74107f6009b48d91e17a81b0fa1/system/controllers/admin/actions/index_chart_data.php#L190 - https://github.com/instantsoft/icms2/blob/4691a1524780e74107f600
m/controllers/admin/actions/index_chart_data.php#L190 - https://github.com/instantsoft/icms2/blob/4691a1524780e74107f6009b48d91e17a81b0fa1/system/core/model.php#L744 - https://user-images.githubusercontent.com/109034767/300806111-a33d9548-d99f-4034-bef3-fbd7fa62c37f.png
CVE ID: CVE-2024-31213 State: PUBLISHED Published: 2024-04-05T14:43:06.893Z Last Updated: 2024-08-02T01:46:04.416Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: instantsoft Products: icms2 Problem Types: CWE-601 Description: InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type
hey could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq
CVE ID: CVE-2024-31214 State: PUBLISHED Published: 2024-04-10T17:20:55.407Z Last Updated: 2024-08-02T01:46:04.605Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: traccar Products: traccar Problem Types: CWE-434 Description: Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file extension, and partial control over the file name. While it's not for an attacker to overwrite an existing file, an attacker can create new files w
rol over the file name. While it's not for an attacker to overwrite an existing file, an attacker can create new files with certain names and attacker-controlled extensions anywhere on the file system. This can potentially lead to remote code execution, XSS, DOS, etc. The default install of Traccar makes this vulnerability more severe. Self-registration is enabled by default, allowing anyone to create an account to exploit this vulnerability. Traccar also runs by default with root/system privileges, allowing files to be placed anywhere on the file system. Version 6.0 contains a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in t
ns a fix for the issue. One may also turn off self-registration by default, as that would make most vulnerabilities in the application much harder to exploit by default and reduce the severity considerably. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/traccar/traccar/security/advisories/GHSA-3gxq-f2qj-c8v9 - https://github.com/traccar/traccar/commit/3fbdcd81566bc72e319ec05c77cf8a4120b87b8f - https://github.com/traccar/traccar/blob/master/src/main/java/org/traccar/model/Device.java#L56 - https://github.com/traccar/traccar/blob/v5.12/src/main/java/org/traccar/api/resource/DeviceResource.java#L191
CVE ID: CVE-2024-31215 State: PUBLISHED Published: 2024-04-04T16:10:18.954Z Last Updated: 2024-08-02T01:46:04.599Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-918 Description: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability h
ure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx - https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716
CVE ID: CVE-2024-31216 State: PUBLISHED Published: 2024-05-15T15:52:15.084Z Last Updated: 2024-08-02T01:46:04.808Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: fluxcd Products: source-controller Problem Types: CWE-532 Description: The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged a
source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w - https:/
m Container: References: - https://github.com/fluxcd/source-controller/security/advisories/GHSA-v554-xwgw-hc3w - https://github.com/fluxcd/source-controller/pull/1430 - https://github.com/fluxcd/source-controller/commit/915d1a072a4f37dd460ba33079dc094aa6e72fa9
CVE ID: CVE-2024-31217 State: PUBLISHED Published: 2024-06-12T14:50:37.999Z Last Updated: 2024-08-02T01:46:04.759Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: strapi Products: strapi Problem Types: CWE-248 Description: Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any c
ep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/strapi/strapi/security/advisories/GHSA-pm9q-xj9p-96pm - https://github.com/strapi/strapi/commit/a0da7e73e1496d835fe71a2febb14f70170135c7
CVE ID: CVE-2024-31218 State: PUBLISHED Published: 2024-04-05T14:45:31.347Z Last Updated: 2024-09-06T18:14:26.603Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: webhood-io Products: webhood Problem Types: CWE-306 Description: Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorizati
Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting wi
e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2 - https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9
CVE ID: CVE-2024-31219 State: PUBLISHED Published: 2024-04-15T18:00:14.783Z Last Updated: 2024-08-02T01:46:04.759Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-reactions Problem Types: CWE-200 Description: Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dis
dpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse-reactions/security/advisories/GHSA-7cqc-5xrw-xh67 - https://github.com/discourse/discourse-reactions/commit/6a5a8dacd7e5cbbbbe7d2288b1df9c1062994dbe
CVE ID: CVE-2024-31220 State: PUBLISHED Published: 2024-04-05T14:59:52.662Z Last Updated: 2024-08-02T01:46:04.755Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: LizardByte Products: Sunshine Problem Types: CWE-22 Description: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.16.0 and prior to version 0.18.0, an attacker may be able to remotely read arbitrary files without authentication due to a path traversal vulnerability. Users who exposed the Sunshine configuration web user interface outside of localhost may be affected, depending on firewall configuration. To exploit vulnerability, attacker could make an http/s request to t
y be affected, depending on firewall configuration. To exploit vulnerability, attacker could make an http/s request to the `node_modules` endpoint if user exposed Sunshine config web server to internet or attacker is on the LAN. Version 0.18.0 contains a patch for this issue. As a workaround, one may block access to Sunshine via firewall. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6rg7-7m3w-w5wc - https://github.com/LizardByte/Sunshine/releases/tag/v0.18.0
CVE ID: CVE-2024-31221 State: PUBLISHED Published: 2024-04-08T15:10:17.071Z Last Updated: 2024-09-03T18:00:09.752Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: LizardByte Products: Sunshine Problem Types: CWE-384 Description: Sunshine is a self-hosted game stream host for Moonlight. Starting in version 0.10.0 and prior to version 0.23.0, after unpairing all devices in the web UI interface and then pairing only one device, all of the previously devices will be temporarily paired. Version 0.23.0 contains a patch for the issue. As a workaround, restarting Sunshine after unpairing all devices prevents the vulnerability. Additional Analyst Notes: - CVE Program
und, restarting Sunshine after unpairing all devices prevents the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LizardByte/Sunshine/security/advisories/GHSA-v8gw-jw28-v55m - https://github.com/LizardByte/Sunshine/issues/2305 - https://github.com/LizardByte/Sunshine/pull/2365 - https://github.com/LizardByte/Sunshine/commit/b7aa8119f1471844dccdf73a8b6f7efc9baddb5e
CVE ID: CVE-2024-31223 State: PUBLISHED Published: 2024-07-03T17:34:48.508Z Last Updated: 2024-08-02T01:46:04.901Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ethyca Products: fides Problem Types: CWE-497 Description: Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated
and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg - https://github.com/ethyca/fides/commit/05
s: - https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg - https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
CVE ID: CVE-2024-31224 State: PUBLISHED Published: 2024-04-08T15:24:01.084Z Last Updated: 2024-08-22T20:12:45.441Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: binary-husky Products: gpt_academic Problem Types: CWE-502 Description: GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched
ulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-jcjc-89wr-vv7g - https://github.com/binary-husky/gpt_academic/pull/1648 - https://github.com/binary-husky/gpt_academic/commit/8af6c0cab6d96f5c4520bec85b24802e6e823f35
CVE ID: CVE-2024-31225 State: PUBLISHED Published: 2024-05-01T06:13:58.610Z Last Updated: 2025-02-13T17:47:52.554Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: RIOT-OS Products: RIOT Problem Types: CWE-120 Description: RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The `_on_rd_init()` function does not implement a size check before copying data to the `_result_buf` static buffer. If an attacker can craft a long enough payload, they could cause a buffer overflow. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact o
use a buffer overflow. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution. This issue has yet to be patched. Users are advised to add manual bounds checking. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-2572-7q7c-3965 - https://github.com/RIOT-OS/RIOT/blob/master/sys/net/application_layer/cord/lc/cord_lc.c#L218 - http://www.openwall.com/lists/oss-security/2024/05/07/3 - http://seclists.org/fulldisclosure/2024/May/7
CVE ID: CVE-2024-31226 State: PUBLISHED Published: 2024-05-16T18:12:57.081Z Last Updated: 2024-08-15T14:28:39.036Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H) Vendors: LizardByte Products: Sunshine Problem Types: CWE-428 Description: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not Engli
n't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected direc
ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LizardByte/Sunshine/security/advisories/GHSA-r3rw-mx4q-7vfp - https://github.com/LizardByte/Sunshine/pull/2379 - https://github.com/LizardByte/Sunshine/commit/93e622342c4f3e9b34f5f265039b6775b8e33a7a
CVE ID: CVE-2024-31227 State: PUBLISHED Published: 2024-10-07T19:51:04.520Z Last Updated: 2024-10-07T20:20:56.702Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-20 Description: Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
e are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-38p4-26x2-vqhh - https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a
CVE ID: CVE-2024-31228 State: PUBLISHED Published: 2024-10-07T19:51:06.784Z Last Updated: 2025-11-03T21:54:38.487Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-674 Description: Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versi
y result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976 - https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0