deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43756
Published: 2024-09-13
Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-119
References: https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE: CVE-2024-43760
Published: 2024-09-13
Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE: CVE-2024-45108
Published: 2024-09-13
Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE: CVE-2024-45109
Published: 2024-09-13
Description: Photoshop Desktop versions 24.7.4, 25.11 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb24-72.html
CVE: CVE-2024-45113
Published: 2024-09-13
Description: ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access and affect the integrity of the application. Exploitation of this issue does not require user interaction.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
CVE: CVE-2024-46044
Published: 2024-09-13
Description: CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/BenJpopo/V/blob/main/Tenda/CH22/fromqossetting.md
CVE: CVE-2024-46045
Published: 2024-09-13
Description: Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/BenJpopo/V/blob/main/Tenda/CH22/frmL7PlotForm.md
CVE: CVE-2024-46046
Published: 2024-09-13
Description: Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/BenJpopo/V/blob/main/Tenda/FH451/RouteStatic.md
CVE: CVE-2024-46047
Published: 2024-09-13
Description: Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/BenJpopo/V/blob/main/Tenda/FH451/DhcpListClient.md
CVE: CVE-2024-46048
Published: 2024-09-13
Description: Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/BenJpopo/V/blob/main/Tenda/FH451/formexeCommand.md
CVE: CVE-2024-46049
Published: 2024-09-13
Description: Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/BenJpopo/V/blob/main/Tenda/O6/formexeCommand.md
CVE: CVE-2022-2446
Published: 2024-09-13
Description: The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset/3151053/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3[PII_REDACTED]-4569-8fd6-f84113593e9d?source=cve
CVE: CVE-2024-46713
Published: 2024-09-13
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/aux: Fix AUX buffer serialization

Ole reported that event->mmap_mutex is strictly insufficient to
serialize the AUX buffer, add a per RB mutex to fully serialize it.

Note that in the lock order comment the perf_event::mmap_mutex order
was already wrong, that is, it nesting under mmap_lock is not new with
this patch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2ab9d830262c132ab5db2f571003d80850d56b2a; https://git.kernel.org/stable/c/52d13d224fdf1299c8b642807fa1ea14d693f5ff; https://git.kernel.org/stable/c/7882923f1cb88dc1a17f2bf0c81b1fc80d44db82
CVE: CVE-2024-5789
Published: 2024-09-13
Description: The Triton Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute within the theme's Button shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/triton-lite/1.3/lib/includes/shortcodes.php#L136; https://www.wordfence.com/threat-intel/vulnerabilities/id/049efe5a-3f68-46ad-b73a-1892f03c9d1d?source=cve
CVE: CVE-2024-5867
Published: 2024-09-13
Description: The Delicate theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter within the theme's Button shortcode in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://themes.trac.wordpress.org/browser/delicate/3.5.5/functions/shortcodes.php#L128; https://www.wordfence.com/threat-intel/vulnerabilities/id/dbf491d6-e546-4e3f-88c2-237b647a2b1e?source=cve
CVE: CVE-2024-5869
Published: 2024-09-13
Description: The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/neighborly/1.4/inc/extras.php#L151; https://www.wordfence.com/threat-intel/vulnerabilities/id/f65834c6-6da7-4033-aa2a-a4926d6c955d?source=cve
CVE: CVE-2024-5870
Published: 2024-09-13
Description: The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/tweaker5/1.2/inc/extras.php#L175; https://www.wordfence.com/threat-intel/vulnerabilities/id/f70ba568-b013-4177-928a-eefb606333ee?source=cve
CVE: CVE-2024-5884
Published: 2024-09-13
Description: The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/beauty/1.1.4/functions.php#L46; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1089958-a481-47b1-9dc6-799a1a7930c8?source=cve
CVE: CVE-2024-6544
Published: 2024-09-13
Description: The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://plugins.trac.wordpress.org/browser/custom-post-limits/trunk/tests/bootstrap.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf4a11e-ad28-4a93-9278-1d2d113a4859?source=cve
CVE: CVE-2024-7423
Published: 2024-09-13
Description: The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/stream/tags/4.0.1/classes/class-network.php#L353; https://plugins.trac.wordpress.org/changeset/3139815/stream/trunk/classes/class-network.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9d15e418-36bb-4f53-ac67-8f6122591dd2?source=cve
CVE: CVE-2024-8242
Published: 2024-09-13
Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L1053; https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/controllers/flutter-user.php; https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/functions/index.php
CVE: CVE-2024-8269
Published: 2024-09-13
Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user account through the register() function. This makes it possible for unauthenticated attackers to create user accounts on sites, even when user registration is disabled and plugin functionality is not activated.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L406; https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.2/controllers/flutter-user.php#L454; https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/controllers/flutter-user.php
CVE: CVE-2024-8714
Published: 2024-09-13
Description: The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/commissions/class-list-table-commissions.php#L544; https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/payouts/class-list-table-payments.php#L490; https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/visits/class-list-table-visits.php#L396
CVE: CVE-2024-8730
Published: 2024-09-13
Description: The Exit Notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.10.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/exit-notifier/trunk/includes/class-exit-notifier-settings.php#L707; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3173864%40exit-notifier%2Ftrunk&old=3162432%40exit-notifier%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc1aedb-e64f-4b61-a247-c3cdc731f001?source=cve
CVE: CVE-2024-8731
Published: 2024-09-13
Description: The Cron Jobs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/leira-cron-jobs/trunk/admin/class-leira-cron-jobs-admin.php#L147; https://plugins.trac.wordpress.org/changeset/3153665/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f6da693-4610-4875-aa14-102809309b8d?source=cve
CVE: CVE-2024-8732
Published: 2024-09-13
Description: The Roles & Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/leira-roles/tags/1.1.9/admin/class-leira-roles-admin.php#L413; https://plugins.trac.wordpress.org/browser/leira-roles/tags/1.1.9/admin/class-leira-roles-admin.php#L541; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153649%40leira-roles&new=3153649%40leira-roles&sfp_email=&sfph_mail=
CVE: CVE-2024-8734
Published: 2024-09-13
Description: The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lucas-string-replace/trunk/includes/class-lucas-string-replace-settings.php#L176; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf1e4b20-e7e5-4a3a-9895-02d51499d54e?source=cve
CVE: CVE-2024-8737
Published: 2024-09-13
Description: The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/pdf-thumbnail-generator/tags/1.3/pdf-thumbnail-generator.php#L184; https://plugins.trac.wordpress.org/changeset/3151055/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b183587b-95bd-4e82-bfc7-db5a8fbd58f9?source=cve
CVE: CVE-2024-8747
Published: 2024-09-13
Description: The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/email-obfuscate-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/77bed6ce-84e7-4b71-8acd-bb5b73e362d2?source=cve
CVE: CVE-2024-42025
Published: 2024-09-13
Description: A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704
CVE: CVE-2024-44685
Published: 2024-09-13
Description: Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwords, is exposed in clear text within the JSON response when configuring SMTP settings via the Web UI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://github.com/ShellFighter/Reports/blob/main/Titan%20MFT%20Server.md; https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-cve-2024-44685
CVE: CVE-2024-44798
Published: 2024-09-13
Description: phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdate and todate parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/shouvikdutta1998/Bus_management
CVE: CVE-2024-6587
Published: 2024-09-13
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/berriai/litellm/commit/ba1912afd1b19e38d3704bb156adf887f91ae1e0; https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
CVE: CVE-2024-31414
Published: 2024-09-13
Description: The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts when abused by bad actors.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
CVE: CVE-2024-31415
Published: 2024-09-13
Description: The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
CVE: CVE-2024-31416
Published: 2024-09-13
Description: The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reports, etc. Some of these input fields were not checking the length and bounds of the entered value. The exploit of this security flaw by a bad actor may result in excessive memory consumption or integer overflow.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-190, CWE-1284
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf
CVE: CVE-2024-43099
Published: 2024-09-13
Description: The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17
CVE: CVE-2024-45368
Published: 2024-09-13
Description: The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execution, namely its acceptance of multiple distinct packets as valid authentication responses. This behavior deviates from standard security practices where a single, specific response or encoding pattern is expected for successful authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17
CVE: CVE-2024-6087
Published: 2024-09-13
Description: An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf; https://huntr.com/bounties/bd9f2301-11c7-4cbd-8d77-3e9225bd67e8