ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rpm4-2vv9-4p54: SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
CVE-2004-2673: Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly execute arbitrary code via (1) a SITE ZIP command with a long first or second argument, or (2) a SITE COPY with a long argument.
CVSS v2.0: 9
GHSA-x6hg-qh4q-23x7: IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passowrds of other users in the Windows AD enviornemnt when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. IBM X-Force ID: 197789.
CVSS v3.1: 6.5
CVE-2020-24770: SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
PYSEC-2021-16: httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.
CVE-2019-8336: HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
GHSA-x896-jjgf-wjp7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4.
CVSS v3.1: 8.5
GHSA-jv4q-hvqc-9497: Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
CVSS v3.1: 8.4
GHSA-8w36-q6qv-jw4f: A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
CVSS v3.1: 6.7
GHSA-m8xj-5v73-3hh8: curlrequest allows execution of arbitrary commands
curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the `options` values.
CVSS v3.1: 9.8
GHSA-8j53-28jm-72jx: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773.
CVSS v3.0: 7.5
CVE-2019-11923: In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.
CVSS v3.1: 7.5
CVSS v2.0: 5
RHSA-2026:2216: Red Hat Security Advisory: libsoup security update
libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
CVSS v3.1: 8.6
GHSA-xqpf-pfm9-3p52: The issue was addressed with improved handling of caches. This issue is fixed in visionOS 1.1, iOS 17.4 and iPadOS 17.4. An app may be able to fingerprint the user.
CVSS v3.1: 4
CVE-2023-28722: Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
GHSA-pf8q-jqv2-qqx2: SQL injection vulnerability in gc.php in GeheimChaos 0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the Temp_entered_password parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
GHSA-72cx-5ff9-4hhc: Cross-site scripting in markdown2 for python
python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
CVSS v4.0: 5.3
CVSS v3.1: 6.1
CVE-2022-22944: VMware Workspace ONE Boxer contains a stored cross-site scripting (XSS) vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-x2q5-92fg-cp24: The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
CVSS v3.0: 6.1
GHSA-phx4-v7wv-5g6f: A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI.
GHSA-w7ph-w892-q2wc: A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated user to cause a Windows blue screen error.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
GHSA-3rx8-q5x6-m56j: A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api/otp/send?id=[ID][ampersand]method=sms of the component OTP URI Interface. The manipulation leads to information exposure through discrepancy. It is possible to initiate the attack remotely. The identifier VDB-233253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 5.3
CVE-2022-29149: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-4r64-m3cx-69p7: Windows GDI+ Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28348, CVE-2021-28350.
CVSS v3.1: 7.8
GHSA-9rv5-7x29-r9cr: CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.
CVSS v3.0: 5.3
GHSA-rvw9-8m2p-4pgm: An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks allows an attacker to cause a Denial of Service (DoS )to the device upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet.Continued receipt of this packet will cause a sustained Denial of Service condition.This issue affects:Juniper Networks Junos OS:All versions prior to 20.4R3-S6;21.1 versions prior to 21.1R3-S5;21.2 versions prior to 21.2R3-S4;21.3 versions prior to 21.3R3-S3;21.4 versions prior to 21.4R3-S3;22.1 versions prior to 22.1R2-S2, 22.1R3;22.2 versions prior to 22.2R2-S1, 22.2R3;22.3 versions prior to 22.3R1-S2, 22.3R2.Juniper Networks Junos OS Evolved:All versions prior to 20.4R3-S6-EVO;21.1-EVO version 21.1R1-EVO and later versions prior to 21.2R3-S4-EVO;21.3-EVO versions prior to 21.3R3-S3-EVO;21.4-EVO versions prior to 21.4R3-S3-EVO;22.1-EVO versions prior to 22.1R3-EVO;22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO;22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO.
CVSS v3.1: 7.5
CVE-2017-20069: Hindu Matrimonial Script countrymanagement.php privileges management
A vulnerability classified as critical has been found in Hindu Matrimonial Script. This affects an unknown part of the file /admin/countrymanagement.php. The manipulation leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1: 6.3
GHSA-5hvp-4x73-f9p6: Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 6.8
CVE-2013-0993: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS v2.0: 6.8
GHSA-mpwf-4gcq-qc4r: Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS v3.0: 8.8
CVE-2020-17002: Azure SDK for C Security Feature Bypass Vulnerability
Azure SDK for C Security Feature Bypass Vulnerability
CVSS v3.1: 7.4
CVE-2025-47695: WordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
CVSS v3.1: 7.5
GHSA-hp49-mh82-66rv: SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-0845: Unspecified vulnerability in the Database Control component in Oracle Enterprise Manager Grid Control 10.1.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS v2.0: 6.8
GHSA-37qf-q5qg-m9f2: SQL injection vulnerability in style.php in e-Vision CMS 2.02 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the template parameter.
GHSA-5hmg-hcp5-2gmp: A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customer_notice/Customer_noticeAction.java of the component HTTP Request Handler. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
RHSA-2011:0477: Red Hat Security Advisory: gstreamer-plugins security update
libmodplug: Integer overflow when reading samples of AMF files libmodplug: ReadS3M stack overflow vulnerability
RHSA-2014:0401: Red Hat Security Advisory: Red Hat JBoss A-MQ 6.1.0 update
bouncycastle: TLS CBC padding timing attack HawtJNI: predictable temporary file name leading to local arbitrary code execution hadoop: man-in-the-middle vulnerability Framework: XML External Entity (XXE) injection flaw Framework: XML External Entity (XXE) injection flaw Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429 Framework: cross-site scripting flaw when using Spring MVC
GHSA-6946-m5h6-646g: Windows ALPC Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-23287, CVE-2022-24505.
CVSS v3.1: 7
CVE-2022-43871: IBM Financial Transaction Manager for SWIFT Services cross-site scripting
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  239707.
CVSS v3.1: 4.6
CVE-2017-12680: Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-59768: Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MNG.ASP'.
CVSS v4.0: 5.1
CVE-2022-0604: Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-7pfj-8mjx-32jj: Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVSS v3.1: 6.8
GHSA-c89h-4r84-43j7: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.
CVSS v3.0: 9.8
GHSA-mq95-27mr-xgrh: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.
CVSS v3.1: 7.5
GHSA-8wq4-qwwj-mvjj: browser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site, which allows user-assisted remote HTTP servers to obtain sensitive information via a URL that requires authentication, as demonstrated by a URL in the SRC attribute of an IMG element.
GHSA-pqw3-898v-hg67: In the Linux kernel, the following vulnerability has been resolved:net/9p/usbg: fix handling of the failed kzalloc() memory allocationOn the linux-next, next-20241108 vanilla kernel, the coccinelle tool gave the
following error report:./net/9p/trans_usbg.c:912:5-11: ERROR: allocation function on line 911 returns
NULL not ERR_PTR on failurekzalloc() failure is fixed to handle the NULL return case on the memory exhaustion.
CVSS v3.1: 5.5
GHSA-jqjc-j9r5-4wf2: beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious attacker can inject arbitrary HTML and JS into template, which will be rendered/executed when visiting preview page. However due to beefree's Content Security Policy not all payloads will execute successfully.This issue has been fixed in version 3.47.0.
CVSS v4.0: 5.3
CVE-2025-46923: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2024-54922: A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters.
CVSS v3.1: 9.8
CVE-2007-3393: Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via crafted DHCP-over-DOCSIS packets.
CVSS v2.0: 5
GHSA-5m6x-53m7-vvg9: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection.This issue affects Web Collection: before 31197.
CVSS v3.1: 9.8
GHSA-4vq8-7jfc-9cvp: Moby firewalld reload removes bridge network isolation
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (dockerd), which is developed as [moby/moby](https://github.com/moby/moby) is commonly referred to as Docker, or Docker Engine.Firewalld is a daemon used by some Linux distributions to provide a dynamically managed firewall. When Firewalld is running, Docker uses its iptables backend to create rules, including rules to isolate containers in one bridge network from containers in other bridge networks.ImpactThe iptables rules created by Docker are removed when firewalld is reloaded using, for example "firewall-cmd --reload", "killall -HUP firewalld", or "systemctl reload firewalld".When that happens, Docker must re-create the rules. However, in affected versions of Docker, the iptables rules that isolate containers in different bridge networks from each other are not re-created.Once these rules have been removed, containers have access to any port, on any container, in any non-internal bridge network, running on the Docker host.Containers running in networks created with `--internal` or equivalent have no access to other networks. Containers that are only connected to these networks remain isolated after a firewalld reload.Where Docker Engine is not running in the host's network namespace, it is unaffected. Including, for example, Rootless Mode, and Docker Desktop.PatchesMoby releases 28.0.0 and newer are not affected. A fix is available in moby release 25.0.13.WorkaroundsAfter reloading firewalld, either:Restart the docker daemon,Re-create bridge networks, orUse rootless mode.Referenceshttps://firewalld.org/
https://firewalld.org/documentation/howto/reload-firewalld.html
CVSS v3.1: 3.3
GHSA-mpjc-8p6m-243w: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 171831.
GHSA-w53r-j3p6-q2w6: Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to read arbitrary server system files by supplying specially crafted document type definitions (DTDs) in an XML request.
CVSS v3.0: 7.5
CVE-2024-40410: Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.
CVSS v3.1: 4.8
GHSA-6rjg-fx3r-69qh: phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message.
GHSA-mv42-px54-87jw: Improper Access Control in Apache Tomcat
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
CVSS v3.0: 8.8
GHSA-76vg-grjj-w595: Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 7.5
CVE-2012-5973: CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request.
CVSS v2.0: 10
GHSA-4fx5-qq2p-q4xp: The Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image URLs in the plugin's timeline widget in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, changes the slideshow type, and then changes it back to an image.
CVSS v3.1: 4.4
GHSA-xgg6-7q2q-mcm5: VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate.
CVE-2023-2323: Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
CVSS v3.0: 6.8
CVE-2014-4264: Unspecified vulnerability in Oracle Java SE 7u60 and 8u5 allows remote attackers to affect availability via unknown vectors related to Security.
CVSS v2.0: 5
GHSA-g2hj-pqc6-m5xm: Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.
RHSA-2022:0722: Red Hat Security Advisory: rh-maven36-httpcomponents-client security update
apache-httpclient: incorrect handling of malformed authority component in request URIs
CVSS v3.1: 5.3
CVE-2022-20312: In WifiP2pManager, there is a possible toobtain WiFi P2P MAC address without user consent due to missing permission check. This could lead to local information disclosure without additional execution privileges needed. User interaction is not needed forexploitationProduct: AndroidVersions: Android-13Android ID: A-192244925
CVSS v3.1: 5.5
GHSA-2cjf-q722-7gc5: SQL injection vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
GHSA-v285-5c63-6rph: A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
CVSS v3.1: 7.5
CVE-2000-0722: Helix GNOME Updater helix-update 0.5 and earlier allows local users to install arbitrary RPM packages by creating the /tmp/helix-install installation directory before root has begun installing packages.
CVSS v2.0: 6.2
GHSA-rm9p-68g4-m5r5: An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
CVSS v3.1: 9.8
GHSA-chfc-5x2p-7fv7: iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
CVSS v3.1: 7.6
GHSA-f5jq-f6j5-w2c3: A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources.
CVSS v3.1: 5.3
GHSA-fqrm-v269-v375: The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3, when using a native SPICE client invocation method, initially makes insecure connections to the SPICE server, which allows man-in-the-middle attackers to spoof the SPICE server.
CVE-2010-2995: The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, different vulnerabilities than CVE-2010-2287.
CVSS v2.0: 10