ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-p4hc-9pjh-55c8: ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
SSRF Bypass in `ssrfcheck` - fails to classify reserved IP address space as invalid`ssrfcheck` is an npm package that serves to provide protection from SSRF by validating URLs or hostname inputs.Resources:Project's GitHub code repository: https://github.com/felippe-regazio/ssrfcheckProject's npm package: https://www.npmjs.com/package/ssrfcheckVulnerabilityThe `ssrfcheck` package maintains a denylist of IP addresses and ranges to check against when validating if an IP address is to be considered as safe or not.However, the IP address list used for the denylist is incomplete and misses a reserved IP address space as defined by the IANA (Internet Assigned Numbers Authority):224.0.0.0/4 - MulticastPractically, this reserved IP address space is used for multicast traffic and would most commonly be used for reserved local communication over network protocols such as UDP, which would make it less likely to be used in a typical SSRF attack in practice.However, such reserved IP address space shouldn't be allowed and it would be responsible of the SSRF protection package to align and conform to an agreed-upon standard of special-purposed addresses that should not be considered a valid public IP address. For reference, the popular npm packages `private-ip` and `ipaddr.js` that are highly dependent-upon to make decisions about SSRF protection and both consider the above mentioned IP address space as reserved and is not considered a valid public IP address.Exploit Proof of ConceptInstall the `ssrfcheck` package:Define an `app.js` file with the programmatic API of `ssrfcheck`:Vulnerable versionsAll versions of ssrfcheck are vulnerable to this issue, up to and including to the latest version of `1.1.1`.Assigned CVE[CVE-2025-8267](https://nvd.nist.gov/vuln/detail/CVE-2025-8267)AuthorLiran Tal
CVSS v4.0: 7.8
CVSS v3.1: 7.5
CVE-2001-0896: Inetd in OpenServer 5.0.5 allows remote attackers to cause a denial of service (crash) via a port scan, e.g. with nmap -PO.
CVSS v2.0: 5
GHSA-79vw-576r-jwjv: Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled
CVE-2024-4822: Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session.
CVSS v3.1: 6.5
CVE-2023-0046: Improper Restriction of Names for Files and Other Resources in lirantal/daloradius
Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to master-branch.
CVSS v3.0: 7.2
CVE-2006-5217: SQL injection vulnerability in giris_yap.asp in Emek Portal 2.1 allows remote attackers to execute arbitrary SQL commands by simultaneously injecting into the user name and pass fields in uyegiris.asp, also known as the Kullanici Adi (k_a) and Sifre (sifre) parameters.
CVSS v2.0: 7.5
GHSA-g3j3-68hm-8gfm: An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS v3.1: 7.2
GHSA-h9h5-32xg-8pxg: A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality of the file /goform/formConnectionSetting. The manipulation of the argument max_Conn leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-qw9c-69xx-p79v: Directory traversal vulnerability in the Kunani ODBC FTP Server 1.0.10 allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in a GET request.
CVE-2024-21167: Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trading Community.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trading Community accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trading Community accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1: 8.1
GHSA-5j5c-v3ff-gmqc: Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
CVSS v3.1: 6.1
CVE-2013-6837: Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.
CVSS v2.0: 4.3
GHSA-q7xq-8h9f-w8wq: Adobe Substance 3D Sampler versions 4.2.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
RHSA-2021:5110: Red Hat Security Advisory: Cryostat security update
jwt-go: access restriction bypass vulnerability
CVSS v3.1: 7.5
GHSA-8vph-jw2x-79f2: In the Linux kernel, the following vulnerability has been resolved:vdpa: Add queue index attr to vdpa_nl_policy for nlattr length checkThe vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
CVE-2025-3760: A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
CVSS v4.0: 4.8
GHSA-gg79-jh7g-xcx7: A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to setup and configure an HPE Moonshot 1500 chassis. This vulnerability could be remotely exploited by an unauthenticated user to cause a directory traversal in user supplied input to the `khuploadfile.cgi` CGI ELF. The directory traversal could lead to Remote Code Execution, Denial of Service, and/or compromise system integrity. **Note:** HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. The HPE Moonshot Provisioning Manager application is discontinued, no longer supported, is not available to download from the HPE Support Center, and no patch is available.
RHSA-2018:2171: Red Hat Security Advisory: kernel security update
hw: cpu: speculative store bypass
CVSS v3.0: 5.6
PYSEC-2019-117: ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
GHSA-pq2v-pvrw-m6q9: Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.
CVE-2021-45637: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6260 before 1.1.0.76, R6800 before 1.2.0.62, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, and AC2600 before 1.2.0.62.
CVSS v3.1: 8.3
CVE-2020-35163: Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain a Use of Insufficiently Random Values Vulnerability.
CVSS v3.1: 5.3
CVE-2024-43794: OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect
OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A patch is available in 1.3.19 and 2.16.0 for this issue.
CVSS v3.1: 6.1
CVE-2026-24915: Out-of-bounds read issue in the media subsystem.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS v3.1: 6.2
CVE-2021-20747: Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
CVSS v3.1: 4.3
CVSS v2.0: 4.3
CVE-2026-2194: D-Link DI-7100G C1 start_proxy_client_email command injection
A flaw has been found in D-Link DI-7100G C1 24.04.18D1. This affects the function start_proxy_client_email. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-8qrm-2wm8-6v53: In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).
CVSS v3.0: 6.1
GHSA-526h-jq57-957j: The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
CVSS v3.1: 4.3
GHSA-gxv5-57fj-mhw8: A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file examresults-par.php of the component Exam Results Page. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269492.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2008-3983: Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to SYS.LT and WMSYS.LT, a different vulnerability than CVE-2008-3982 and CVE-2008-3984.
CVSS v2.0: 5.5
GHSA-cqqp-93v3-9577: Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0418, and CVE-2014-0424.
CVE-2010-2971: loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546.  NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
CVSS v2.0: 9.3
CVE-2018-9265: In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2026-22476: WordPress Etchy theme <= 1.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Etchy etchy allows PHP Local File Inclusion.This issue affects Etchy: from n/a through <= 1.0.
CVSS v3.1: 8.1
RHSA-2013:1480: Red Hat Security Advisory: thunderbird security update
Mozilla: Miscellaneous memory safety hazards (rv:17.0.10) (MFSA 2013-93) Mozilla: Improperly initialized memory and overflows in some JavaScript functions (MFSA 2013-96) Mozilla: Use-after-free when updating offline cache (MFSA 2013-98) Mozilla: Miscellaneous use-after-free issues found through ASAN fuzzing (MFSA 2013-100) Mozilla: Miscellaneous use-after-free issues found through ASAN fuzzing (MFSA 2013-100) Mozilla: Miscellaneous use-after-free issues found through ASAN fuzzing (MFSA 2013-100) Mozilla: Memory corruption in workers (MFSA 2013-101) Mozilla: Access violation with XSLT and uninitialized data (MFSA 2013-95)
CVE-2018-3891: An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability.
CVSS v3.0: 5.7
CVE-2012-2407: Buffer overflow in RealNetworks RealPlayer before 15.0.6.14, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer before 12.0.1.1750 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted AAC file that is not properly handled during stream-data unpacking.
CVSS v2.0: 7.5
CVE-2024-38375: @fastly/js-compute use-after-free in some host call implementations
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.
CVSS v3.1: 5.3
CVE-2018-20034: A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon to stop, and the vendor daemon to shut down.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2022-28860: An authentication downgrade in the server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to achieve HTTP access to the camera.
CVSS v3.1: 5.9
RHSA-2025:4048: Red Hat Security Advisory: xmlrpc-c security update
libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat
CVSS v3.1: 7.5
GHSA-r86x-h62p-fj22: ASUS RT-AC68U, RT-AC66R, RT-AC66U, RT-AC56R, RT-AC56U, RT-N66R, RT-N66U, RT-N56R, RT-N56U, and possibly other RT-series routers before firmware 3.0.0.4.376.x do not verify the integrity of firmware (1) update information or (2) downloaded updates, which allows man-in-the-middle (MITM) attackers to execute arbitrary code via a crafted image.
RHSA-2018:1296: Red Hat Security Advisory: rh-php70-php security, bug fix, and enhancement update
php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field php: Use after free in wddx_deserialize php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile php: Stack based buffer overflow in msgfmt_format_message php: Missing type check when unserializing SplArray php: Null pointer dereference in php_wddx_push_element php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object gd: Stack overflow in gdImageFillToBorder on truecolor images php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow php: Invalid read when wddx decodes empty boolean element php: Use After Free in unserialize() php: Wrong calculation in exif_convert_any_to_int function php: Integer overflow in phar_parse_pharfile php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive php: Out-of-bounds heap read on unserialize in finish_nested_data() php: Null pointer dereference when unserializing PHP object gd: DoS vulnerability in gdImageCreateFromGd2Ctx() gd: Integer overflow in gd_io.c php: Use of uninitialized memory in unserialize() php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function oniguruma: Out-of-bounds stack read in match_at() during regular expression searching oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching oniguruma: Out-of-bounds heap write in bitset_set_range() oniguruma: Invalid pointer dereference in left_adjust_char_head() php: Incorrect WDDX deserialization of boolean parameters leads to DoS php: Incorrect return value check of OpenSSL sealing function leads to crash php: wddx_deserialize() heap out-of-bound read via php_parse_date() php: Out-of-bounds read in phar_parse_pharfile php: Stack-based buffer over-read in msgfmt_parse_message function php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c php: Heap use after free in ext/standard/var_unserializer.re php: buffer over-read in finish_nested_data function php: heap use after free in ext/standard/var_unserializer.re php: Out-of-bound read in timelib_meridian() gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c php: Reflected XSS on PHAR 404 page
CVSS v3.0: 6.1
CVE-2026-33584: Arqit SKA-Platform Enables Access to Debug Information
Exposed Keycloak management 
service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug 
information such as metrics and
 health data. This issue affects Symmetric Key Agreement Platform: before 26.03.
CVSS v3.1: 5.3
CVE-2022-32790: This issue was addressed with improved checks. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, macOS Big Sur 11.6.6, Security Update 2022-004 Catalina. A remote user may be able to cause a denial-of-service.
CVSS v3.1: 7.5
CVE-2021-38460: Moxa MXview Network Management Software
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
CVSS v3.1: 7.5
CVE-2007-3629: SQL injection vulnerability in oku.asp in Levent Veysi Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 10
GHSA-rhmj-7wff-g848: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest themes Mocho Blog theme <= 1.0.4 versions.
CVSS v3.1: 7.1
CVE-2018-0335: A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring a specific World-Readable file for this authentication data (Cleartext Passwords). An exploit could allow the attacker to gain authentication information for other users. Cisco Bug IDs: CSCvd86602.
CVSS v3.0: 7.8
CVSS v2.0: 2.1
CVE-2013-2506: app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
CVSS v2.0: 4
CVE-2026-0555: Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint
The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the `state` parameter. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the Premmerce Wizard admin page).
CVSS v3.1: 6.4
CVE-2020-14515: CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code) has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm Code are affected.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-m9w3-gv68-h6xv: A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.
CVSS v3.0: 7.5
GHSA-vrpj-wv5c-r9r4: The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
GHSA-v8rm-r2cv-mvp7: Belkin F5D7232-4 and F5D7230-4 wireless routers with firmware 4.03.03 and 4.05.03, when a legitimate administrator is logged into the web management interface, allow remote attackers to access the management interface without authentication.
CVE-2022-21370: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
CVE-2015-0818: Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation.
CVSS v2.0: 7.5
CVE-2017-8547: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8519.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
CVE-2023-50436: An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.
CVSS v3.1: 5.3