deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0510
Published: 2021-06-21
Description: In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-176444622
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0511
Published: 2021-06-21
Description: In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11Android ID: A-178055795
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0512
Published: 2021-06-21
Description: In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-173843328References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0513
Published: 2021-06-21
Description: In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper state validation. This could lead to local escalation of privilege via hidden services with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-156090809
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0516
Published: 2021-06-21
Description: In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out of bounds read and write due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181660448
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0517
Published: 2021-06-21
Description: In updateCapabilities of ConnectivityService.java, there is a possible incorrect network state determination due to a logic error in the code. This could lead to biasing of networking tasks to occur on non-VPN networks, which could lead to remote information disclosure, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-179053823
CVSS Score: 7.5 (HIGH)
CWE: CWE-670
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0520
Published: 2021-06-21
Description: In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-176237595
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0521
Published: 2021-06-21
Description: In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174661955
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0522
Published: 2021-06-21
Description: In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-174182139
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-416
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0523
Published: 2021-06-21
Description: In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-174047492
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0525
Published: 2021-06-21
Description: In memory management driver, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185193929
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0526
Published: 2021-06-21
Description: In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195264
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0527
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185193931
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0528
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195266
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0529
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195268
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0530
Published: 2021-06-21
Description: In memory management driver, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185196175
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0531
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195272
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0532
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185196177
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-0533
Published: 2021-06-21
Description: In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185193932
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/2021-06-01; https://source.android.com/security/bulletin/2021-06-01
CVE: CVE-2021-26461
Published: 2021-06-21
Description: Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E; https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E
CVE: CVE-2020-19510
Published: 2021-06-21
Description: Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://blog.topsec.com.cn/textpattern-background-any-file-upload/; http://blog.topsec.com.cn/textpattern-background-any-file-upload/
CVE: CVE-2020-19511
Published: 2021-06-21
Description: Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://blog.topsec.com.cn/typesetter-5-1-storage-type-cross-site-script/; http://www.typesettercms.com; http://blog.topsec.com.cn/typesetter-5-1-storage-type-cross-site-script/
CVE: CVE-2021-21422
Published: 2021-06-21
Description: mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b; https://github.com/mongo-express/mongo-express/issues/577; https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p
CVE: CVE-2021-32697
Published: 2021-06-21
Description: neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data. Alternatively a custom Finisher can be added as first finisher. This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/neos/form-ghsa-m5vx-8chx-qvmm/pull/1; https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567; https://github.com/neos/form/commit/69de4219b1f58157e2be6b[PII_REDACTED]5d75c246
CVE: CVE-2020-27511
Published: 2021-06-21
Description: An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.
CVSS Score: 7.5 (HIGH)
References: http://prototypejs.org/; https://github.com/prototypejs/prototype/blob/dee2f7d8611248abce81287e1be[PII_REDACTED]c90/src/prototype/lang/string.js#L283; https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md
CVE: CVE-2021-24338
Published: 2021-06-21
Description: The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d5b015f3-90c7-4d51-a71d-630d60965151; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24338; https://wpscan.com/vulnerability/d5b015f3-90c7-4d51-a71d-630d60965151
CVE: CVE-2021-24339
Published: 2021-06-21
Description: The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8e72236d-f620-4503-a324-dcf49405351b; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24339; https://wpscan.com/vulnerability/8e72236d-f620-4503-a324-dcf49405351b
CVE: CVE-2021-24361
Published: 2021-06-21
Description: In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpgeodirectory.com/downloads/location-manager/; https://wpscan.com/vulnerability/5aff50fc-ac96-4076-a07c-bb145ae37025; https://wpgeodirectory.com/downloads/location-manager/
CVE: CVE-2021-24364
Published: 2021-06-21
Description: The Jannah WordPress theme before 5.4.4 did not properly sanitize the options JSON parameter in its tie_get_user_weather AJAX action before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382; https://wpscan.com/vulnerability/1d53fbe5-a879-42ca-a9d3-768a80018382
CVE: CVE-2021-24366
Published: 2021-06-21
Description: The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
References: https://github.com/codepress/admin-columns/commit/b45571ed21d574d13687213a5002e0c68e4442c7; https://wpscan.com/vulnerability/05427156-4d5c-4aeb-add8-1c574fda5c28; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-24366
CVE: CVE-2021-24367
Published: 2021-06-21
Description: The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f35b7c8f-cfb6-42b6-8a3a-8c07cd1e9da0; https://wpscan.com/vulnerability/f35b7c8f-cfb6-42b6-8a3a-8c07cd1e9da0
CVE: CVE-2021-24369
Published: 2021-06-21
Description: In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1d1a731b-78f7-4d97-b40d-80f66700edae; https://wpscan.com/vulnerability/1d1a731b-78f7-4d97-b40d-80f66700edae
CVE: CVE-2021-24370
Published: 2021-06-21
Description: The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://lists.openwall.net/full-disclosure/2020/11/17/2; https://seclists.org/fulldisclosure/2020/Nov/30; https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
CVE: CVE-2021-24372
Published: 2021-06-21
Description: The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/5340ae4e-95ba-4a69-beb1-3459cac17782; https://wpscan.com/vulnerability/5340ae4e-95ba-4a69-beb1-3459cac17782
CVE: CVE-2021-24373
Published: 2021-06-21
Description: The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fcf17278-609f-4f75-8a87-9b4579dee1c8; https://wpscan.com/vulnerability/fcf17278-609f-4f75-8a87-9b4579dee1c8
CVE: CVE-2021-24374
Published: 2021-06-21
Description: The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories/; https://wpscan.com/vulnerability/08a8a51c-49d3-4bce-b7e0-e365af1d8f33; https://jetpack.com/2021/06/01/jetpack-9-8-engage-your-audience-with-wordpress-stories/
CVE: CVE-2021-24376
Published: 2021-06-21
Description: The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e; https://wpscan.com/vulnerability/93edcc23-894a-46c2-84d2-407dcb64ba1e
CVE: CVE-2021-24377
Published: 2021-06-21
Description: The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-362
References: https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a[PII_REDACTED]e4; https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a[PII_REDACTED]e4
CVE: CVE-2021-24378
Published: 2021-06-21
Description: The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/375bd694-1a30-41af-bbd4-8a8ee54f0dbf; https://wpscan.com/vulnerability/375bd694-1a30-41af-bbd4-8a8ee54f0dbf
CVE: CVE-2021-24379
Published: 2021-06-21
Description: The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://wpscan.com/vulnerability/aae7a889-195c-45a3-bbe4-e6d4cd2d7fd9; https://wpscan.com/vulnerability/aae7a889-195c-45a3-bbe4-e6d4cd2d7fd9
CVE: CVE-2021-24383
Published: 2021-06-21
Description: The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.html; https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954; http://packetstormsecurity.com/files/163261/WordPress-WP-Google-Maps-8.1.11-Cross-Site-Scripting.html
CVE: CVE-2021-29061
Published: 2021-06-21
Description: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when the application attempts to validate crafted URIs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/fracpete/vfsjfilechooser2/commit/9c9f2c317f3de5ece60a3ae28c371e9796e3909b; https://github.com/fracpete/vfsjfilechooser2/issues/7; https://github.com/fracpete/vfsjfilechooser2/releases/tag/vfsjfilechooser2-0.2.9