Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36470 State: PUBLISHED Published: 2023-06-29T20:31:54.366Z Last Updated: 2024-11-26T19:17:50.731Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-74 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. T
ere are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. The [icon picker](https://extensions.xwiki.org/xwiki/bin/view/Extension/Icon%20Theme%20Application#HIconPicker) can be used to trigger the rendering of any icon set. The XWiki syntax variant of the icon set is also used without any escaping in some documents, allowing to inject XWiki syntax including script macros into a document that might have programming right, for this the currently used icon theme needs to be edited. Further, the HTML output of the icon set is output as JSON in the icon picker and this JSON is interpreted as XWiki syntax, allowing again the injection of
n set is output as JSON in the icon picker and this JSON is interpreted as XWiki syntax, allowing again the injection of script macros into a document with programming right and thus allowing remote code execution. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This issue has been patched in XWiki 14.10.6 and 15.1. Icon themes now require script right and the code in the icon theme is executed within the context of the icon theme, preventing any rights escalation. A macro for displaying icons has been introduced to avoid injecting the raw wiki syntax of an icon set into another document. Users are advised to upgrade. There are no known workarounds f
the raw wiki syntax of an icon set into another document. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf - https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94 - https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4 - https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7 - https://jira.xwiki.org/browse/XWIKI-20524
CVE ID: CVE-2023-36471 State: PUBLISHED Published: 2023-06-29T19:44:27.211Z Last Updated: 2024-11-26T19:25:17.668Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-commons Problem Types: CWE-74 Description: Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{gr
in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document. This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the t
d tags from the list of allowed tags. Users are advised to upgrade. As a workaround an admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-6pqf-c99p-758v - https://github.com/xwiki/xwiki-commons/commit/99484d48e899a68a1b6e33d457825b776c6fe8c3 - https://jira.xwiki.org/browse/XCOMMONS-2634
CVE ID: CVE-2023-36472 State: PUBLISHED Published: 2023-09-15T18:54:34.072Z Last Updated: 2024-09-25T15:00:46.751Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: strapi Products: strapi Problem Types: CWE-200 Description: Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
xed in version 4.11.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4 - https://github.com/strapi/strapi/releases/tag/v4.11.7
CVE ID: CVE-2023-36473 State: PUBLISHED Published: 2023-07-13T20:57:50.880Z Last Updated: 2024-10-21T21:09:43.744Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source discussion platform. A CSP (Content Security Policy) nonce reuse vulnerability could allow XSS attacks to bypass CSP protection. There are no known XSS vectors at the moment, but should one be discovered, this vulnerability would allow the XSS attack to completely bypass CSP. The vulnerability is patched in the latest tests-passed, beta and stable branches. Additional Analyst Notes: - CVE Program Container:
lity is patched in the latest tests-passed, beta and stable branches. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-9f52-624j-8ppq
CVE ID: CVE-2023-36474 State: PUBLISHED Published: 2023-06-28T21:20:22.455Z Last Updated: 2024-11-06T17:16:00.767Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: projectdiscovery Products: interactsh Problem Types: CWE-79 Description: Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a
as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m3
ainer: - CISA ADP Vulnrichment: References: - https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78 - https://github.com/projectdiscovery/interactsh/issues/136 - https://github.com/projectdiscovery/interactsh/pull/155 - https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/
CVE ID: CVE-2023-36475 State: PUBLISHED Published: 2023-06-28T22:32:10.081Z Last Updated: 2024-11-27T14:44:09.330Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-1321 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-commun
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 - https://github.com/parse-community/parse-server/issues/8674 - https://github.com/parse-community/parse-server/issues/8675 - https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 - https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f - https://github.com/parse-community/parse-server/releases/tag/5.5.2 - https://github.com/parse-community/parse-server/releases/tag/6.2.1
CVE ID: CVE-2023-36476 State: PUBLISHED Published: 2023-06-29T00:18:42.532Z Last Updated: 2024-11-27T14:17:28.175Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: NixOS Products: calamares-nixos-extensions Problem Types: CWE-200 Description: calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd.
ition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/calamares-nixos-extensions/security/advisories/GHSA-3rvf-24q2-24ww - https://github.com/osresearch/heads/issues/1348 - https://github.com/vlinkz/calamares-nixos-extensions/commit/837ca4da5521a74d3b5ca6f7b88890a6713faa22
CVE ID: CVE-2023-36477 State: PUBLISHED Published: 2023-06-30T18:57:38.354Z Last Updated: 2024-12-04T17:05:21.052Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `CKEditor' space. This makes it possible to perform a variety of harmful actions, such as removing technical documents, leading to loss of service and editing the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and X
the javascript configuration of CKEditor, leading to persistent XSS. This issue has been patched in XWiki 14.10.6 and XWiki 15.1. This issue has been patched on the CKEditor Integration extension 1.64.9 for XWiki version older than 14.6RC1. Users are advised to upgrade. Users unable to upgrade may manually address the issue by restricting the `edit` and `delete` rights to a trusted user or group (e.g. the `XWiki.XWikiAdminGroup` group), implicitly disabling those rights for all other users. See commit `9d9d86179` for details. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hr
er: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-793w-g325-hrw2 - https://github.com/xwiki/xwiki-platform/commit/9d9d86179457cb8dc48b4491510537878800be4f - https://jira.xwiki.org/browse/CKEDITOR-508 - https://jira.xwiki.org/browse/XWIKI-20590
CVE ID: CVE-2023-36478 State: PUBLISHED Published: 2023-10-10T16:53:07.063Z Last Updated: 2025-02-13T16:56:19.080Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: eclipse Products: jetty.project Problem Types: CWE-190, CWE-400 Description: Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very lar
name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this le
ngth value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r - https://github.com/eclipse/jetty.project/pull/9634 - https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16 -
ps://github.com/eclipse/jetty.project/pull/9634 - https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16 - https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16 - https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009 - http://www.openwall.com/lists/oss-security/2023/10/18/4 - https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html - https://www.debian.org/security/2023/dsa-5540 - https://security.netapp.com/advisory/ntap-20231116-0011/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2023-36479 State: PUBLISHED Published: 2023-09-15T18:37:35.948Z Last Updated: 2025-06-18T14:41:11.113Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: eclipse Products: jetty.project Problem Types: CWE-149 Description: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be exec
the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j - https://github.com/eclipse/jetty.project/pull/9516 - https://github.com/eclipse/jetty.project/pull/9888 - https://github.com/
://github.com/eclipse/jetty.project/pull/9516 - https://github.com/eclipse/jetty.project/pull/9888 - https://github.com/eclipse/jetty.project/pull/9889 - https://www.debian.org/security/2023/dsa-5507 - https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html
CVE ID: CVE-2023-36480 State: PUBLISHED Published: 2023-08-04T14:29:34.806Z Last Updated: 2024-10-17T14:59:59.067Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aerospike Products: aerospike-client-java Problem Types: CWE-502 Description: The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especial
rther validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/aerospike/aerospike-client-java/security/advisories/GHSA-jj95-55cr-9597 - https://github.com/aerospike/aerospike-client-java/commit/02bf28e62fb186f004c82c87b219db2fc5b8262a - https://github.com/aerospike/aerospik
/aerospike/aerospike-client-java/commit/02bf28e62fb186f004c82c87b219db2fc5b8262a - https://github.com/aerospike/aerospike-client-java/commit/51c65e32837da29435161a2d9c09bbdc2071ecae - https://github.com/aerospike/aerospike-client-java/commit/66aafb4cd743cf53baffaeaf69b035f51d2e2e36 - https://github.com/aerospike/aerospike-client-java/commit/80c508cc5ecb0173ce92d7fab8cfab5e77bd9900 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/AsyncRead.java#L68 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L1157
-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L1157 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L489 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/async/NettyCommand.java#L596 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/command/Buffer.java#L53 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/clien
Buffer.java#L53 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/command/Command.java#L2083 - https://github.com/aerospike/aerospike-client-java/blob/e40a49b3db0d2b3d45068910e1cb9d917c795315/client/src/com/aerospike/client/util/Unpacker.java#L227 - https://support.aerospike.com/s/article/CVE-2023-36480-Aerospike-Java-Client-vulnerable-to-unsafe-deserialization-of-server-responses
CVE ID: CVE-2023-36481 State: PUBLISHED Published: 2023-08-28T00:00:00 Last Updated: 2024-10-02T17:33:14.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, and W920. Improper handling of PPP length parameter inconsistency can cause an infinite loop. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-36482 State: PUBLISHED Published: 2023-08-08T00:00:00 Last Updated: 2024-10-17T14:20:24.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Samsung NFC S3NRN4V, S3NSN4V, S3NSEN4, SEN82AB, and S3NRN82. A buffer copy without checking its input size can cause an NFC service restart. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE ID: CVE-2023-36483 State: PUBLISHED Published: 2024-03-16T00:00:00 Last Updated: 2024-08-28T16:23:17.832Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: MAS (a Carrier brand) Products: MASmobile Classic, MAS ASP.Net Services Problem Types: CWE-639 Description: Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.c
d event history. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/product-security/advisories-resources/
CVE ID: CVE-2023-36484 State: PUBLISHED Published: 2023-06-29T00:00:00 Last Updated: 2024-11-26T21:18:38.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141710&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI - https://docu.ilias.de/ilias.php?ref_id=1719&obj_id=141711&obj_type=PageObject&cmd=layout&cmdClass=illmpresentationgui&cmdNode=13g&baseClass=ilLMPresentationGUI
CVE ID: CVE-2023-36485 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T16:45:56.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ILIAS-eLearning/ILIAS/pull/5987 - https://github.com/ILIAS-eLearning/ILIAS/pull/5988 - https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&pr
s.de/ilias.php?baseClass=ilrepositorygui&cmdNode=xd:kx:54&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=3439&prvm=fsc&bmn=2023-12&blpg=786