Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-29394 State: PUBLISHED Published: 2020-11-30T00:00:00 Last Updated: 2024-08-04T16:55:09.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows arbitrary code execution because fscanf is misused (no limit on the number of characters to be read in the format argument). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GENIVI/dlt-daemon/issues/274 - https://github.com/GENIVI/dlt-daemon/pull/275 - https://github.com/GENIVI/dlt-daemon/pull/288 - https://lists.debian.org/debian-lts-announce/2022/12/msg0
mon/pull/275 - https://github.com/GENIVI/dlt-daemon/pull/288 - https://lists.debian.org/debian-lts-announce/2022/12/msg00016.html
CVE ID: CVE-2020-29395 State: PUBLISHED Published: 2020-11-30T19:05:03 Last Updated: 2024-08-04T16:55:09.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS - https://www.myeventon.com/news/ - http://packetstormsecurity.com/files/160282/WordPress-EventON-Calendar-3.0.5-Cross-Site-Scripting.html
CVE ID: CVE-2020-29396 State: PUBLISHED Published: 2020-12-22T16:25:39 Last Updated: 2024-08-04T16:55:09.224Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-267 Description: A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows remote authenticated users to execute arbitrary code, leading to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/odoo/odoo/issues/63712 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2020-29397 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29398 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29399 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29400 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29401 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29402 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29403 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29404 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29405 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29406 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29407 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29408 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29410 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2020-29436 State: PUBLISHED Published: 2020-12-17T01:53:13 Last Updated: 2024-08-04T16:55:09.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/1500000415082-CVE-2020-29436-Nexus-Repository-Manager-3-XML-External-Entities-injection-2020-12-15
CVE ID: CVE-2020-29437 State: PUBLISHED Published: 2021-01-05T20:30:55 Last Updated: 2024-08-04T16:55:09.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orangehrm/orangehrm/issues/695 - https://www.horizon3.ai/disclosures/orangehrm-sqli.html - https://github.com/orangehrm/orangehrm/pull/699 - https://github.com/orangehrm/orangehrm/releases
CVE ID: CVE-2020-29438 State: PUBLISHED Published: 2020-11-30T21:24:03 Last Updated: 2024-08-04T16:55:09.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE ID: CVE-2020-29439 State: PUBLISHED Published: 2020-11-30T21:23:41 Last Updated: 2024-08-04T16:55:09.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module (BCM) to initiate a Bluetooth wake-up action. (The full VIN is visible from outside the vehicle.) Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE ID: CVE-2020-29440 State: PUBLISHED Published: 2020-11-30T21:23:12 Last Updated: 2024-08-04T16:55:09.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This allows an attacker (who is inside a vehicle, or is otherwise able to send data over the CAN bus) to start and drive the vehicle with a spoofed key fob. Additional Analyst Notes: - CVE Program Container: References: - https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE ID: CVE-2020-29441 State: PUBLISHED Published: 2020-11-30T21:36:51 Last Updated: 2024-08-04T16:55:09.667Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:L/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space (Denial of Service), corrupt legitimate data if files are being processed asynchronously, or deny access to legitimate uploaded files. Additional Analyst Notes: - CVE Program Container: References: - https://success.outsystems.com/Support/Securi
ed files. Additional Analyst Notes: - CVE Program Container: References: - https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RPD-4310
CVE ID: CVE-2020-29443 State: PUBLISHED Published: 2021-01-22T07:05:46 Last Updated: 2024-08-04T16:55:09.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html - http://www.openwall.com/lists/oss-security/2021/01/18/2 - https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html - https://security.netapp.com/advisory/ntap-20210304-0003/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE ID: CVE-2020-29444 State: PUBLISHED Published: 2021-05-07T06:10:11.632Z Last Updated: 2025-02-12T20:56:00.990Z Vendors: Atlassian Products: Confluence Server Problem Types: Cross Site Scripting Description: Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-61266
CVE ID: CVE-2020-29445 State: PUBLISHED Published: 2021-05-07T06:10:12.303Z Last Updated: 2025-02-12T20:56:52.029Z Vendors: Atlassian Products: Confluence Server Problem Types: Server-Side Request Forgery Description: Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-61453
CVE ID: CVE-2020-29446 State: PUBLISHED Published: 2021-01-18T01:30:16.421702Z Last Updated: 2024-09-17T02:21:39.035Z Vendors: Atlassian Products: Fisheye, Crucible Problem Types: Insecure Direct Object References (IDOR) Description: Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8496 - https://jira.atlassian.com/browse/FE-7326
CVE ID: CVE-2020-29447 State: PUBLISHED Published: 2020-12-21T00:25:20.470645Z Last Updated: 2024-09-16T23:05:37.593Z Vendors: Atlassian Products: Crucible Problem Types: Denial of Service (DoS) Description: Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4, and from version 4.8.0 before 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8505
CVE ID: CVE-2020-29448 State: PUBLISHED Published: 2021-02-18T15:08:59.028136Z Last Updated: 2024-09-17T02:31:11.206Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Arbitrary File Read Description: The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-60469
CVE ID: CVE-2020-29450 State: PUBLISHED Published: 2021-01-19T00:30:14.158347Z Last Updated: 2024-09-16T17:49:14.701Z Vendors: Atlassian Products: Confluence Server Problem Types: Denial of Service Description: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-60854
CVE ID: CVE-2020-29451 State: PUBLISHED Published: 2021-02-15T00:45:14.942861Z Last Updated: 2024-09-16T16:33:16.867Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72000
CVE ID: CVE-2020-29453 State: PUBLISHED Published: 2021-02-18T15:09:34.184843Z Last Updated: 2024-09-17T00:15:39.961Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Arbitrary File Read Description: The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72014
CVE ID: CVE-2020-29454 State: PUBLISHED Published: 2020-12-02T01:50:03 Last Updated: 2024-08-04T16:55:09.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/pull/9361
CVE ID: CVE-2020-29455 State: PUBLISHED Published: 2020-12-11T19:50:44 Last Updated: 2024-08-04T16:55:10.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country). Additional Analyst Notes: - CVE Program Container: References: - https://jsfiddle.net/smartystreets/Lx2dbsaa/ - https://github.com/smartystreets-archives - https://www.guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure/
CVE ID: CVE-2020-29456 State: PUBLISHED Published: 2020-12-02T07:50:23 Last Updated: 2024-08-04T16:55:10.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authenti
lication. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.papermerge.com/ - https://github.com/ciur/papermerge/issues/228 - https://github.com/ciur/papermerge/releases/tag/v1.5.2
CVE ID: CVE-2020-29457 State: PUBLISHED Published: 2021-02-16T19:19:19 Last Updated: 2024-08-04T16:55:09.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OPCFoundation/UA-.NETStandard - https://www.nuget.org/packages/OPCFoundation.NetStandard.Opc.Ua/ - https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2020-29457.pdf
CVE ID: CVE-2020-29458 State: PUBLISHED Published: 2020-12-02T08:12:10 Last Updated: 2024-08-04T16:55:10.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48907
CVE ID: CVE-2020-29469 State: PUBLISHED Published: 2020-12-30T14:47:51 Last Updated: 2024-08-04T16:55:09.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49164
CVE ID: CVE-2020-29470 State: PUBLISHED Published: 2020-12-29T16:21:56 Last Updated: 2024-08-04T16:55:10.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49099
CVE ID: CVE-2020-29471 State: PUBLISHED Published: 2020-12-29T16:21:00 Last Updated: 2024-08-04T16:55:09.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49098
CVE ID: CVE-2020-29472 State: PUBLISHED Published: 2020-12-24T19:28:48 Last Updated: 2024-08-04T16:55:10.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49150 - https://systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683
CVE ID: CVE-2020-29474 State: PUBLISHED Published: 2020-12-24T19:36:16 Last Updated: 2024-08-04T16:55:10.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49182 - https://systemweakness.com/cve-2020-29474-egavilanmedia-address-book-1-0-exploit-sqli-auth-bypass-228cd4864262
CVE ID: CVE-2020-29475 State: PUBLISHED Published: 2020-12-29T14:47:34 Last Updated: 2024-08-04T16:55:10.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49093
CVE ID: CVE-2020-29477 State: PUBLISHED Published: 2020-12-30T14:19:13 Last Updated: 2024-08-04T16:55:09.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - http://invision.com - https://www.exploit-db.com/exploits/49188
CVE ID: CVE-2020-29478 State: PUBLISHED Published: 2021-01-05T17:24:46 Last Updated: 2024-08-04T16:55:09.794Z Vendors: CA Technologies, A Broadcom Company Products: CA Service Catalog Problem Types: CWE-258 Description: CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/security-advisory/content/security-advisories/CA20201215-01-Security-Notice-for-CA-Service-Catalog/ESDSA16810
CVE ID: CVE-2020-29479 State: PUBLISHED Published: 2020-12-15T17:06:50 Last Updated: 2024-08-04T16:55:10.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree is a host-wide denial of service.) Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable. Bu
de denial of service.) Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xenproject.org/xsa/advisory-353.html - https://www.debian.org/security/2020/dsa-4812 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2C6M6S3CIMEBACH6O7V4H2V
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2C6M6S3CIMEBACH6O7V4H2VDANMO6TVA/ - https://security.gentoo.org/glsa/202107-30
CVE ID: CVE-2020-29480 State: PUBLISHED Published: 2020-12-15T17:08:13 Last Updated: 2024-08-04T16:55:10.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created and destroyed. Data may include: number, type, and domids of other VMs; existence and domids of driver domains; numbers of virtual in
. Data may include: number, type, and domids of other VMs; existence and domids of driver domains; numbers of virtual interfaces, block devices, vcpus; existence of virtual framebuffers and their backend style (e.g., existence of VNC service); Xen VM UUIDs for other domains; timing information about domain creation and device setup; and some hints at the backend provisioning of VMs and their devices. The watch events do not contain values stored in xenstore, only key names. A guest administrator can observe non-sensitive domain and device lifecycle events relating to other guests. This information allows some insight into overall system configuration (including the number and general nature