Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t is rendered. Users are advised to upgrade to the appropriate fix versions detailed in the advisory metadata. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lara-zeus/dynamic-dashboard/security/advisories/GHSA-c6cw-g7fc-4gwc - https://github.com/lara-zeus/artemis/commit/3a3f9dd8a706af569c5581b20dcfeff91a43b9d9 - https://github.com/lara-zeus/dynamic-dashboard/commit/adfb4b1cdfdaa01299631f0e569ce201a7cc545a
CVE ID: CVE-2024-47818 State: PUBLISHED Published: 2024-10-07T21:10:22.072Z Last Updated: 2024-10-08T14:18:42.962Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: saltcorn Products: saltcorn Problem Types: CWE-22 Description: Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There a
ing `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/saltcorn/saltcorn/security/advisories/GHSA-43f3-h63w-p6f6 - https://github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a - https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.15/packages/server/routes/sync.js#L337-L346
CVE ID: CVE-2024-47819 State: PUBLISHED Published: 2024-10-22T15:25:03.501Z Last Updated: 2024-10-22T15:55:27.159Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: umbraco Products: Umbraco-CMS Problem Types: CWE-79 Description: Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a
ally elevate all users and grant them admin privileges or access protected content. Versions 14.3.1 and 15.0.0 contain a patch. As a workaround, ensure that access to the Dictionary section is only granted to trusted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-c5g6-6xf7-qxp3
CVE ID: CVE-2024-47820 State: PUBLISHED Published: 2024-11-18T16:57:11.771Z Last Updated: 2024-11-18T19:05:12.639Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: MarkUsProject Products: Markus Problem Types: CWE-22 Description: MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment:
arounds are available at the application level aside from upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarkUsProject/Markus/security/advisories/GHSA-wq6v-vx8c-8fj8 - https://github.com/MarkUsProject/Markus/pull/7026
CVE ID: CVE-2024-47821 State: PUBLISHED Published: 2024-10-25T22:48:57.950Z Last Updated: 2024-10-28T19:41:54.018Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: pyload Products: pyload Problem Types: CWE-78 Description: pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/script
rior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-w7hq-f2pj-c53g
CVE ID: CVE-2024-47822 State: PUBLISHED Published: 2024-10-08T17:54:21.088Z Last Updated: 2025-04-14T12:02:32.509Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: directus Products: directus Problem Types: CWE-532 Description: Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized d
tized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp - https://github.com/directus/directus/commit/2e893f9c576d5a02506272fe2c0bcc12e6c58768
CVE ID: CVE-2024-47823 State: PUBLISHED Published: 2024-10-08T17:48:36.496Z Last Updated: 2025-07-17T18:22:08.024Z Vendors: livewire Products: livewire Problem Types: CWE-20 Description: Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual file extension from the file name is not validated. An attacker can therefore bypass the validation by uploading a file with a valid MIME type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an
E type (e.g., `image/png`) and a “.php” file extension. If the following criteria are met, the attacker can carry out an RCE attack: 1. Filename is composed of the original file name using `$file->getClientOriginalName()`. 2. Files stored directly on your server in a public storage disk. 3. Webserver is configured to execute “.php” files. This issue has been addressed in release versions `2.12.7` and `3.5.2`. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp - https://github.com/livewire/livewire/pull/8624 - https
b.com/livewire/livewire/security/advisories/GHSA-f3cx-396f-7jqp - https://github.com/livewire/livewire/pull/8624 - https://github.com/livewire/livewire/commit/70503b79f5db75a1eac9bf55826038a6ee5a16d5 - https://github.com/livewire/livewire/commit/cd168c6212ea13d13b82b3132485741f82d9fad9
CVE ID: CVE-2024-47824 State: PUBLISHED Published: 2024-10-15T15:40:37.397Z Last Updated: 2024-11-21T16:52:42.888Z Vendors: matrix-org Products: matrix-react-sdk Problem Types: CWE-200 Description: matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by d
because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-qcvh-p9jq-wp8v - https://github.com/matrix-org/matrix-react-sdk/pull/12618 - https://github.com/matrix-org/matrix-react-sdk/commit/6fc9d7641c51ca3db8225cf58b9d6e6fdd2d6556
CVE ID: CVE-2024-47825 State: PUBLISHED Published: 2024-10-21T19:05:55.430Z Last Updated: 2024-10-21T19:59:01.283Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-276 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `t
narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
explicitly specify `toEntities: all`, use `toEntities: world`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-3wwx-63fv-pfq6
CVE ID: CVE-2024-47826 State: PUBLISHED Published: 2024-10-14T17:59:26.283Z Last Updated: 2024-10-15T14:52:50.140Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: elabftw Products: elabftw Problem Types: CWE-79, CWE-94 Description: eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "aler
h will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-cjww-pr9f-4c4w - https://www.acunetix.com/vulnerabilities/web/html-injection
CVE ID: CVE-2024-47827 State: PUBLISHED Published: 2024-10-28T15:10:55.772Z Last Updated: 2025-04-04T20:43:57.325Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-workflows Problem Types: CWE-362, CWE-1108 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-wo
fixed in 3.6.0-rc2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr - https://github.com/argoproj/argo-workflows/pull/13641 - https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a - https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75
CVE ID: CVE-2024-47828 State: PUBLISHED Published: 2024-10-09T18:35:20.080Z Last Updated: 2024-10-09T20:20:57.365Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: ampache Products: ampache Problem Types: CWE-352 Description: ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects (Playlist, smartlist etc.). Cross-Site Request Forgery (CSRF) is an attack that forces authenticated users to submit a request to a Web application against which they are currently authenticated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to an
icated. This vulnerability can be exploited by creating a malicious script with an arbitrary playlist ID belonging to another user. When the user submits the request, their playlist will be deleted. Any User with active sessions who are tricked into submitting a malicious request are impacted, as their playlists or other objects could be deleted without their consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ampache/ampache/security/advisories/GHSA-p9cq-2qph-55f2
CVE ID: CVE-2024-47829 State: PUBLISHED Published: 2025-04-23T15:42:12.623Z Last Updated: 2025-04-23T16:08:45.843Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: pnpm Products: pnpm Problem Types: CWE-328 Description: pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0. Additional Analyst Notes: -
ion numbers for the libraries they refer to. This issue has been patched in version 10.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4
CVE ID: CVE-2024-47830 State: PUBLISHED Published: 2024-10-11T14:55:36.961Z Last Updated: 2024-10-15T16:15:20.916Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H) Vendors: makeplane Products: plane Problem Types: CWE-918 Description: Plane is an open-source project management tool. Plane uses the ** wildcard support to retrieve the image from any hostname as in /web/next.config.js. This may permit an attacker to induce the server side into performing requests to unintended locations. This vulnerability is fixed in 0.23.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348 - htt
- CISA ADP Vulnrichment: References: - https://github.com/makeplane/plane/security/advisories/GHSA-39gx-38xf-c348 - https://github.com/makeplane/plane/commit/b9f78ba42b70461c8c1d26638fa8b9beef6a96a1
CVE ID: CVE-2024-47831 State: PUBLISHED Published: 2024-10-14T18:04:25.927Z Last Updated: 2024-10-15T14:52:10.465Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vercel Products: next.js Problem Types: CWE-674 Description: Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.
e that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m - https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a
CVE ID: CVE-2024-47832 State: PUBLISHED Published: 2024-10-09T18:32:19.800Z Last Updated: 2024-10-11T16:58:48.177Z Vendors: ssoready Products: ssoready Problem Types: CWE-347 Description: ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-
ise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ssoready/ssoready/security/advisories/GHSA-j2hr-q93x-gxvh - https://github.com/ssoready/ssoready/commit/7f92a0630439972fcbefa8c7eafe8c144bd89915 - https://ssoready.com/docs/self-hosting/self-hosting-sso-ready
CVE ID: CVE-2024-47833 State: PUBLISHED Published: 2024-10-09T18:25:02.563Z Last Updated: 2024-10-09T19:55:10.993Z Vendors: Avaiga Products: taipy Problem Types: CWE-614, CWE-1004 Description: Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Avaiga/taipy/security/advisories/GHSA-r3jq-4r5c-j9hp
CVE ID: CVE-2024-47834 State: PUBLISHED Published: 2024-12-11T19:18:04.069Z Last Updated: 2025-11-03T20:40:55.432Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-416 Description: GStreamer is a library for constructing graphs of media-handling components. An Use-After-Free read vulnerability has been discovered affecting the processing of CodecPrivate elements in Matroska streams. In the GST_MATROSKA_ID_CODECPRIVATE case within the gst_matroska_demux_parse_stream function, a data chunk is allocated using gst_ebml_read_binary. Later, the allocated memory is freed in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accesse
in the gst_matroska_track_free function, by the call to g_free (track->codec_priv). Finally, the freed memory is accessed in the caps_serialize function through gst_value_serialize_buffer. The freed memory will be accessed in the gst_value_serialize_buffer function. This results in a UAF read vulnerability, as the function tries to process memory that has already been freed. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-280_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch - https://gstreamer.freedesktop.org/security
ps://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057.patch - https://gstreamer.freedesktop.org/security/sa-2024-0030.html
CVE ID: CVE-2024-47835 State: PUBLISHED Published: 2024-12-11T19:17:26.688Z Last Updated: 2025-11-03T22:21:51.646Z Vendors: gstreamer Products: gstreamer Problem Types: CWE-476 Description: GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been detected in the parse_lrc function within gstsubparse.c. The parse_lrc function calls strchr() to find the character ']' in the string line. The pointer returned by this call is then passed to g_strdup(). However, if the string line does not contain the character ']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability i
']', strchr() returns NULL, and a call to g_strdup(start + 1) leads to a null pointer dereference. This vulnerability is fixed in 1.24.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2024-263_Gstreamer/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8039.patch - https://gstreamer.freedesktop.org/security/sa-2024-0029.html
CVE ID: CVE-2024-47836 State: PUBLISHED Published: 2024-10-16T19:43:07.894Z Last Updated: 2024-10-16T20:07:29.259Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Admidio Products: admidio Problem Types: CWE-502 Description: Admidio is an open-source user management solution. Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Version 4.3.12 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Admidio/admidio/security/advisories/GHSA-7c4c-749j-pfp2
CVE ID: CVE-2024-47840 State: PUBLISHED Published: 2024-10-05T00:53:38.813Z Last Updated: 2024-10-07T17:15:49.923Z Vendors: The Wikimedia Foundation Products: Mediawiki - Apex skin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T368628 - https://phabricator.wikimedia.org/T370081 - https://gerrit.wikimedia.org/r/q/I
tps://phabricator.wikimedia.org/T368628 - https://phabricator.wikimedia.org/T370081 - https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7