Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6 - https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f8
/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6 - https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q - https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc - https://github.com/yhatt/jsx-slack/releases/tag/v4.5.2
CVE ID: CVE-2021-43844 State: PUBLISHED Published: 2021-12-20T21:20:11 Last Updated: 2024-08-04T04:10:16.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rcmaehl Products: MSEdgeRedirect Problem Types: CWE-610 Description: MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability requires user interaction and the acceptance of a prompt. With how MSEdgeRedirect is coded, parameters are impossible to pass to any launched file. However, there are two possible scenarios in which an att
coded, parameters are impossible to pass to any launched file. However, there are two possible scenarios in which an attacker can do more than a minor annoyance. In Scenario 1 (confirmed), a user visits an attacker controlled webpage; the user is prompted with, and downloads, an executable payload; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and RCE executes the payload the user previously downloaded, if the download path is successfully guessed. In Scenario 2 (not yet confirmed), a user visits an attacked controlled webpage; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and a payload on a remote, attacker controlled, SMB se
rompted with, and accepts, the aforementioned crafted URL prompt; and a payload on a remote, attacker controlled, SMB server is executed. The issue was found in the _DecodeAndRun() function, in which I incorrectly assumed _WinAPI_UrlIs() would only accept web resources. Unfortunately, file:/// passes the default _WinAPI_UrlIs check(). File paths are now directly checked for and must fail. There is no currently known exploitation of this vulnerability in the wild. A patched version, 0.5.0.1, has been released that checks for and denies these crafted URLs. There are no workarounds for this issue. Users are advised not to accept any unexpected prompts from web pages. Additional Analyst Notes: -
ounds for this issue. Users are advised not to accept any unexpected prompts from web pages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rcmaehl/MSEdgeRedirect/security/advisories/GHSA-95v4-748v-fmf9 - https://github.com/rcmaehl/MSEdgeRedirect/releases/tag/0.5.0.1
CVE ID: CVE-2021-43845 State: PUBLISHED Published: 2021-12-27T00:00:00.000Z Last Updated: 2025-11-04T16:09:26.963Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: pjsip Products: pjproject Problem Types: CWE-125 Description: PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. This affects all users that use PJMEDIA and RTCP XR. A malicious actor can send a RTCP XR message with an invalid packet size. Additional Analyst Notes: - CVE Program Container: Reference
tor can send a RTCP XR message with an invalid packet size. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-r374-qrwv-86hh - https://github.com/pjsip/pjproject/pull/2924 - https://github.com/pjsip/pjproject/commit/f74c1fc22b760d2a24369aa72c74c4a9ab985859 - https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285 - https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
CVE ID: CVE-2021-43846 State: PUBLISHED Published: 2021-12-20T21:30:11 Last Updated: 2024-08-04T04:10:16.776Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: solidusio Products: solidus Problem Types: CWE-352 Description: `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery
1.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/solidusio/solidus/security/advisories/GHSA-h3fg-h5v3-vf8m - https://github.com/solidusio/solidus/commit/4d17cacf066d9492fc04eb3a0b16084b47376d81 - https://github.com/solidusio/solidus/commit/a1b9bf7f24f9b8684fc4d943eacb02b1926c77c6
CVE ID: CVE-2021-43847 State: PUBLISHED Published: 2021-12-20T21:35:12 Last Updated: 2024-08-04T04:10:17.072Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: humhub Products: humhub Problem Types: CWE-285 Description: HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74 - https://github.com/humhub/humhub/pull/5473 - https://gith
ub.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74 - https://github.com/humhub/humhub/pull/5473 - https://github.com/humhub/humhub/releases/tag/v1.10.3 - https://github.com/humhub/humhub/releases/tag/v1.9.3 - https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/
CVE ID: CVE-2021-43848 State: PUBLISHED Published: 2022-02-01T12:13:56.000Z Last Updated: 2025-04-23T19:08:39.448Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: h2o Products: h2o Problem Types: CWE-908 Description: h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker o
, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o. This internal state includes traffic of other connections in unencrypted form and TLS session tickets. This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability. There are no known workarounds. Users of unreleased versions of h2o using HTTP/3 are advised to upgrade immediately. Additional Analyst Notes
rkarounds. Users of unreleased versions of h2o using HTTP/3 are advised to upgrade immediately. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4 - https://github.com/h2o/h2o/commit/8c0eca3
CVE ID: CVE-2021-43849 State: PUBLISHED Published: 2021-12-23T16:20:10 Last Updated: 2024-08-04T04:10:16.890Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NiklasMerz Products: cordova-plugin-fingerprint-aio Problem Types: CWE-617 Description: cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any
cause the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NiklasMerz/cordova-plugin-finger
le. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/security/advisories/GHSA-7vfx-hfvm-rhr8 - https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/commit/27434a240f97f69fd930088654590c8ba43569df - https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio/releases/tag/v5.0.1
CVE ID: CVE-2021-43850 State: PUBLISHED Published: 2022-01-04T19:35:11.000Z Last Updated: 2025-04-22T18:34:44.857Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-20 Description: Discourse is an open source platform for community discussion. In affected versions admins users can trigger a Denial of Service attack via the `/message-bus/_diagnostics` path. The impact of this vulnerability is greater on multisite Discourse instances (where multiple forums are served from a single application server) where any admin user on any of the forums are able to visit the `/message-bus/_diagnostics` path. The problem has b
ver) where any admin user on any of the forums are able to visit the `/message-bus/_diagnostics` path. The problem has been patched. Please upgrade to 2.8.0.beta10 or 2.7.12. No workarounds for this issue exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-59jr-pj65-qmvr - https://github.com/discourse/discourse/commit/7a8ec129fb54f188b2da6588c9d24d3a36eb0d39
CVE ID: CVE-2021-43851 State: PUBLISHED Published: 2021-12-21T23:40:10 Last Updated: 2024-08-04T04:10:16.291Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: anuko Products: timetracker Problem Types: CWE-89 Description: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an enti
een organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/anuko/timetracker/security/advisories/GHSA-wx6x-6rq3-pqcc - htt
CVE Program Container: References: - https://github.com/anuko/timetracker/security/advisories/GHSA-wx6x-6rq3-pqcc - https://github.com/anuko/timetracker/commit/0cf32f1046418aa2e5218b0b370064820c330c6a - https://github.com/anuko/timetracker/commit/94fda0cc0c9c20ab98d38ccc75ff040d13dc7f1b
CVE ID: CVE-2021-43852 State: PUBLISHED Published: 2022-01-04T19:40:10.000Z Last Updated: 2025-04-23T19:15:19.979Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H) Vendors: oroinc Products: platform Problem Types: CWE-74 Description: OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests co
tion. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hj - https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9
CVE ID: CVE-2021-43853 State: PUBLISHED Published: 2021-12-22T20:55:09 Last Updated: 2024-08-04T04:10:16.314Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: michaelschwarz Products: Ajax.NET-Professional Problem Types: CWE-79 Description: Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaS
ing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelschwarz/Ajax.NET-Professional/security/advisories/GHSA-5q7q-qqw2-hjq7 - https://github.com/michaelschwarz/Ajax.NET-Professional/commit/c89e39b9679fcb8ab6644fe21cc7e652cb615e2b - https://github.com/michaelschwarz/Ajax.NET-Professional/releases/tag/v21.12.22.1
CVE ID: CVE-2021-43854 State: PUBLISHED Published: 2021-12-23T17:55:11 Last Updated: 2024-08-04T04:10:16.281Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: nltk Products: nltk Problem Types: CWE-400 Description: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a speci
nd word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, then we would strongly recommend upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions. Our recommendation is to implement such a limit. Additional Analyst Notes: - CVE Program Container: References: - https:/
ur recommendation is to implement such a limit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nltk/nltk/security/advisories/GHSA-f8m6-h2c7-8h9x - https://github.com/nltk/nltk/issues/2866 - https://github.com/nltk/nltk/pull/2869 - https://github.com/nltk/nltk/commit/1405aad979c6b8080dbbc8e0858f89b2e3690341
CVE ID: CVE-2021-43855 State: PUBLISHED Published: 2021-12-27T18:05:16 Last Updated: 2024-08-04T04:10:16.298Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Requarks Products: wiki Problem Types: CWE-79 Description: Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via
licious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/wiki/releases/tag/2.5.264 - https://github.com/Requarks/wiki/security/advisori
References: - https://github.com/Requarks/wiki/releases/tag/2.5.264 - https://github.com/Requarks/wiki/security/advisories/GHSA-4893-pj5w-3hq9 - https://github.com/Requarks/wiki/commit/57b56d3a5b9c00358814e76f3ee5b4bb353ad62f
CVE ID: CVE-2021-43856 State: PUBLISHED Published: 2021-12-27T18:05:10 Last Updated: 2024-08-04T04:10:16.851Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Requarks Products: wiki Problem Types: CWE-79 Description: Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser (e.g. XML files), a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the
user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the file is viewed directly by other users. The file must be opened directly by the user and will not trigger directly in a normal Wiki.js page. A patch in version 2.5.264 fixes this vulnerability by adding an optional (enabled by default) force download flag to all non-image file types, preventing the file from being viewed inline in the browser. As a workaround, disable file upload for all non-trusted users. --- Thanks to @Haxatron for reporting this vulnerability. Initially reported via https://huntr.dev/bounties/266bff09-00d9-43ca-a4bb-bb540642811f/ Additional Analyst Notes
bility. Initially reported via https://huntr.dev/bounties/266bff09-00d9-43ca-a4bb-bb540642811f/ Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Requarks/wiki/security/advisories/GHSA-rhpf-929m-7fm2 - https://github.com/Requarks/wiki/commit/79bdd4409316adf649806de3e22352297f85cee0 - https://github.com/Requarks/wiki/releases/tag/2.5.264
CVE ID: CVE-2021-43857 State: PUBLISHED Published: 2021-12-27T18:30:10 Last Updated: 2024-08-04T04:10:17.159Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gerapy Products: Gerapy Problem Types: CWE-78 Description: Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Gerapy/Gerapy/issues/219 - https://github.com/Gerapy/Gerapy/security/advisories/GHSA-9w7f-m4j4-j3xw - https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28 - http://pac
ries/GHSA-9w7f-m4j4-j3xw - https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28 - http://packetstormsecurity.com/files/165459/Gerapy-0.9.7-Remote-Code-Execution.html
CVE ID: CVE-2021-43858 State: PUBLISHED Published: 2021-12-27T21:20:11 Last Updated: 2024-08-04T04:10:17.197Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: minio Products: minio Problem Types: CWE-269 Description: MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwo
oves the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx - https://github.com/minio/minio/pull/13976 - https://github.com/minio/minio/pull/7949 - https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf - https://github.com/minio/minio/releases/tag/RELEASE.2021-12-27T07-23-18Z
CVE ID: CVE-2021-43859 State: PUBLISHED Published: 2022-02-01T12:08:57.000Z Last Updated: 2025-11-03T21:45:34.625Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-400 Description: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if