deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5618
Published: 2024-07-18
Description: Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Apinizer Management Console: before 2024.05.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-732
References: https://www.usom.gov.tr/bildirim/tr-24-1010; https://www.usom.gov.tr/bildirim/tr-24-1010
CVE: CVE-2024-5619
Published: 2024-07-18
Description: Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apinizer Management Console: before 2024.05.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-24-1010; https://www.usom.gov.tr/bildirim/tr-24-1010
CVE: CVE-2024-5620
Published: 2024-07-18
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows Authentication Bypass.This issue affects Apinizer Management Console: before 2024.05.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288
References: https://www.usom.gov.tr/bildirim/tr-24-1010; https://www.usom.gov.tr/bildirim/tr-24-1010
CVE: CVE-2024-0857
Published: 2024-07-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection.This issue affects FlexWater Corporate Water Management: before 5.452.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1011; https://www.usom.gov.tr/bildirim/tr-24-1011
CVE: CVE-2024-30125
Published: 2024-07-18
Description: HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the server process to die.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-918
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113886; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113886
CVE: CVE-2024-5625
Published: 2024-07-18
Description: Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Entities Blowup.This issue affects Apinizer Management Console: before 2024.05.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.usom.gov.tr/bildirim/tr-24-1010; https://www.usom.gov.tr/bildirim/tr-24-1010
CVE: CVE-2024-38806
Published: 2024-07-18
Description: Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation  v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 ,
 potentially resulting in users retaining access rights they should not 
have.  This can allow them to perform operations beyond their intended 
permissions.
CVSS Score: 3.9 (LOW)
CWE: CWE-440
References: https://www.cloudfoundry.org/blog/cve-2024-38806-uaa-failure-to-remove-shadow-users-access; https://www.cloudfoundry.org/blog/cve-2024-38806-uaa-failure-to-remove-shadow-users-access
CVE: CVE-2024-39152
Published: 2024-07-18
Description: Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-6655. Reason: This record is a reservation duplicate of CVE-2024-6655. Notes: All CVE users should reference CVE-2024-6655 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2024-5321
Published: 2024-07-18
Description: A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-276
References: https://github.com/kubernetes/kubernetes/issues/126161; https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0; http://www.openwall.com/lists/oss-security/2024/07/17/3
CVE: CVE-2024-30126
Published: 2024-07-18
Description: HCL BigFix Compliance is affected by a missing X-Frame-Options HTTP header which can allow an attacker to create a malicious website that embeds the target website in a frame or iframe, tricking users into performing actions on the target website without their knowledge.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113886; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113886
CVE: CVE-2024-39090
Published: 2024-07-18
Description: The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's session, potentially leading to account takeover.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/arijitdirghanji/My-CVEs/blob/main/CVE-2024-39090.md; https://github.com/arijitdirghanji/My-CVEs/blob/main/CVE-2024-39090.md
CVE: CVE-2024-39173
Published: 2024-07-18
Description: calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the input field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-95
References: http://kropov.com/calculator-boilerplate-cve.txt; http://kropov.com/calculator-boilerplate-cve.txt
CVE: CVE-2024-6455
Published: 2024-07-18
Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15; https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=cve; https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15
CVE: CVE-2024-5997
Published: 2024-07-18
Description: The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_user and duplicate_post functions in all versions up to, and including, 0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create duplicates of users and posts/pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/duplica/tags/0.6/src/AJAX.php#L32; https://plugins.trac.wordpress.org/browser/duplica/tags/0.6/src/AJAX.php#L98; https://www.wordfence.com/threat-intel/vulnerabilities/id/605fac87-e1e8-4354-a9d3-4440e54bc161?source=cve
CVE: CVE-2024-40642
Published: 2024-07-18
Description: The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly validate input values thus giving attackers almost complete control over the HTTP requests constructed from the parsed output. Attackers can abuse several issues individually to perform various injection attacks including HTTP request smuggling, desync attacks, HTTP header injections, request queue poisoning, caching attacks and Server Side Request Forgery (SSRF). Attacker could also combine several issues to create well-formed messages for other text-based protocols which may result in attacks beyond the HTTP protocol. The BinaryHttpParser class implements the readRequestHead method which performs most of the relevant parsing of the received request. The data structure prefixes values with a variable length integer value. The parsing code below first gets the lengths of the values from the prefixed variable length integer. After it has all of the lengths and calculates all of the indices, the parser casts the applicable slices of the ByteBuf to String. Finally, it passes these values into a new `DefaultBinaryHttpRequest` object where no further parsing or validation occurs. Method is partially validated while other values are not validated at all. Software that relies on netty to apply input validation for binary HTTP data may be vulnerable to various injection and protocol based attacks. This issue has been addressed in version 0.0.13.Final. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://github.com/netty/netty-incubator-codec-ohttp/commit/b687a0cf6ea1030232ea204d73bce82f2698e571; https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-q8f2-hxq5-cp4h; https://github.com/netty/netty-incubator-codec-ohttp/commit/b687a0cf6ea1030232ea204d73bce82f2698e571
CVE: CVE-2024-41111
Published: 2024-07-18
Description: Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver version 1.6.0 (prerelease) is vulnerable to RCE on the teamserver by a low-privileged "operator" user. The RCE is as the system root user. The exploit is pretty fun as we make the Sliver server pwn itself. As described in a past issue (#65), "there is a clear security boundary between the operator and server, an operator should not inherently be able to run commands or code on the server." An operator who exploited this vulnerability would be able to view all console logs, kick all other operators, view and modify files stored on the server, and ultimately delete the server. This issue has not yet be addressed but is expected to be resolved before the full release of version 1.6.0. Users of the 1.6.0 prerelease should avoid using Silver in production.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://github.com/BishopFox/sliver/commit/5016fb8d7cdff38c79e22e8293e58300f8d3bd57; https://github.com/BishopFox/sliver/issues/65; https://github.com/BishopFox/sliver/pull/1281
CVE: CVE-2024-30130
Published: 2024-07-19
Description: HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
CVSS Score: 3.7 (LOW)
CWE: CWE-525
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114184; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0114184
CVE: CVE-2024-35198
Published: 2024-07-19
Description: TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which effectively bypasses the allowed_urls security check. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed by validating the URL without characters such as ".." before downloading see PR #3082. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-706
References: https://github.com/pytorch/serve/pull/3082; https://github.com/pytorch/serve/releases/tag/v0.11.0; https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2
CVE: CVE-2024-35199
Published: 2024-07-19
Description: TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to [localhost](http://localhost/) by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected. This issue in TorchServe has been fixed in PR #3083. TorchServe release 0.11.0 includes the fix to address this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-668
References: https://github.com/pytorch/serve/pull/3083; https://github.com/pytorch/serve/releases/tag/v0.11.0; https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w
CVE: CVE-2024-38156
Published: 2024-07-19
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38156; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38156
CVE: CVE-2024-6898
Published: 2024-07-19
Description: A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument UserName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271923.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-01.md; https://vuldb.com/?ctiid.271923; https://vuldb.com/?id.271923
CVE: CVE-2024-21527
Published: 2024-07-19
Description: Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request is made to a file via localhost, such as <iframe src="\\localhost/etc/passwd">. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. WorkaroundAn alternative is using either or both --chromium-deny-list and --chromium-allow-list flags.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: https://gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356; https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794; https://github.com/gotenberg/gotenberg/releases/tag/v8.1.0
CVE: CVE-2024-21583
Published: 2024-07-19
Description: Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-15, CWE-565
References: https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d; https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155; https://github.com/gitpod-io/gitpod/pull/19973
CVE: CVE-2024-6899
Published: 2024-07-19
Description: A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file view_info.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271924.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-02.md; https://vuldb.com/?ctiid.271924; https://vuldb.com/?id.271924
CVE: CVE-2023-7268
Published: 2024-07-19
Description: The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets,  allowing ay authenticated users, such as subscriber, to delete arbitrary widgets
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/9ac233dd-e00d-4aee-a41c-0de6e8aaefd7/; https://wpscan.com/vulnerability/9ac233dd-e00d-4aee-a41c-0de6e8aaefd7/
CVE: CVE-2023-7269
Published: 2024-07-19
Description: The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/1e8e1186-323b-473b-a0c4-580dc94020d7/; https://wpscan.com/vulnerability/1e8e1186-323b-473b-a0c4-580dc94020d7/
CVE: CVE-2024-5604
Published: 2024-07-19
Description: The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/29985150-8d49-4a3f-8411-5d7263b424d8/; https://wpscan.com/vulnerability/29985150-8d49-4a3f-8411-5d7263b424d8/
CVE: CVE-2024-6205
Published: 2024-07-19
Description: The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087/; https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087/
CVE: CVE-2024-6900
Published: 2024-07-19
Description: A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file edit_emp.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271925 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-03.md; https://vuldb.com/?ctiid.271925; https://vuldb.com/?id.271925
CVE: CVE-2024-6901
Published: 2024-07-19
Description: A vulnerability classified as critical has been found in SourceCodester Record Management System 1.0. Affected is an unknown function of the file entry.php. The manipulation of the argument school leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-271926 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-04.md; https://vuldb.com/?ctiid.271926; https://vuldb.com/?id.271926
CVE: CVE-2024-40724
Published: 2024-07-19
Description: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://github.com/assimp/assimp/pull/5651/commits/614911bb3b1bfc3a1799ae2b3cca306270f3fb97; https://github.com/assimp/assimp/releases/tag/v5.4.2; https://jvn.jp/en/jp/JVN87710540/
CVE: CVE-2024-6338
Published: 2024-07-19
Description: The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up to, and including, 7.5.46.7212 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/trunk/models/video-encoder/class.fv-player-encoder-list-table.php#L308; https://plugins.trac.wordpress.org/changeset/3121532/; https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
CVE: CVE-2024-6799
Published: 2024-07-19
Description: The YITH Essential Kit for WooCommerce #1 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_module', 'deactivate_module', and 'install_module' functions in all versions up to, and including, 2.34.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install, activate, and deactivate plugins from a pre-defined list of available YITH plugins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/yith-essential-kit-for-woocommerce-1/trunk/class-yith-jetpack.php#L425; https://plugins.trac.wordpress.org/browser/yith-essential-kit-for-woocommerce-1/trunk/class-yith-jetpack.php#L457; https://plugins.trac.wordpress.org/browser/yith-essential-kit-for-woocommerce-1/trunk/class-yith-jetpack.php#L487
CVE: CVE-2024-6902
Published: 2024-07-19
Description: A vulnerability classified as critical was found in SourceCodester Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file sort_user.php. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271927.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-05.md; https://vuldb.com/?ctiid.271927; https://vuldb.com/?id.271927
CVE: CVE-2024-6903
Published: 2024-07-19
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Record Management System 1.0. Affected by this issue is some unknown functionality of the file sort1_user.php. The manipulation of the argument position leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271928.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-06.md; https://vuldb.com/?ctiid.271928; https://vuldb.com/?id.271928
CVE: CVE-2024-29736
Published: 2024-07-19
Description: A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2; http://www.openwall.com/lists/oss-security/2024/07/18/2; https://lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2