deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-51330
Published: 2024-11-15
Description: An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism between Cura application and CuraEngine processes, localhost network stack, printing settings and G-code processing and transmission components, Ultimaker 3D Printers.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/HalaAli198/ff06d7a94c06cdfb821dec4d6303e01b
CVE: CVE-2024-10934
Published: 2024-11-15
Description: In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, 
avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-457
References: https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig; https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig
CVE: CVE-2024-11256
Published: 2024-11-15
Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/8; https://vuldb.com/?ctiid.284711
CVE: CVE-2024-11257
Published: 2024-11-15
Description: A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/10; https://vuldb.com/?ctiid.284715
CVE: CVE-2024-11258
Published: 2024-11-15
Description: A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Hacker0xone/CVE/issues/11; https://vuldb.com/?ctiid.284716
CVE: CVE-2024-11259
Published: 2024-11-15
Description: A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /fornecedores.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/13u11erFly/cve/blob/main/xss.md; https://vuldb.com/?ctiid.284717
CVE: CVE-2024-24452
Published: 2024-11-15
Description: An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24453
Published: 2024-11-15
Description: An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24454
Published: 2024-11-15
Description: An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24455
Published: 2024-11-15
Description: An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24457
Published: 2024-11-15
Description: An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24458
Published: 2024-11-15
Description: An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-24459
Published: 2024-11-15
Description: An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-3334
Published: 2024-11-15
Description: A security bypass vulnerability exists in the Removable Media Encryption (RME)component of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://support.fortra.com/endpoint-dlp/kb-articles/dg-support-notice-security-bypass-vulnerability-with-rme-MTQwYTM5NTctZDk4Ny1lZjExLWFjMjEtNjA0NWJkMDFhMzQ3; https://www.fortra.com/security/advisories/product-security/fi-2024-013
CVE: CVE-2024-44759
Published: 2024-11-15
Description: An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-44759.md; https://github.com/WarmBrew/web_vul/blob/main/M9ERP/M9ERP-filedown-Doc.md
CVE: CVE-2024-45609
Published: 2024-11-15
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-3j2f-3j4v-hppr
CVE: CVE-2024-49536
Published: 2024-11-15
Description: Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/audition/apsb24-83.html
CVE: CVE-2017-13309
Published: 2024-11-15
Description: In readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2024-11217
Published: 2024-11-15
Description: A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-1295
References: https://access.redhat.com/security/cve/CVE-2024-11217; https://bugzilla.redhat.com/show_bug.cgi?id=2326230
CVE: CVE-2024-44758
Published: 2024-11-15
Description: An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary code via uploading crafted files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-44758.md; https://github.com/WarmBrew/web_vul/blob/main/M9ERP/M9ERP-upload.md
CVE: CVE-2024-45610
Published: 2024-11-15
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-vvr8-chwj-9m4c
CVE: CVE-2024-45611
Published: 2024-11-15
Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-j73h-x6j3-m479
CVE: CVE-2024-49060
Published: 2024-11-15
Description: Azure Stack HCI Elevation of Privilege Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49060
CVE: CVE-2024-49592
Published: 2024-11-15
Description: Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncontrolled Search Path Element. The attacker could be "an adversary or knowledgeable user" and the type of attack could be called "DLL-squatting." The issue only affects execution of this installer, and does not leave McAfee Total Protection in a vulnerable state after installation is completed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://www.mcafee.com/support/s/article/000002516?language=en_US
CVE: CVE-2017-13310
Published: 2024-11-15
Description: In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2017-13311
Published: 2024-11-15
Description: In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2017-13312
Published: 2024-11-15
Description: In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2017-13313
Published: 2024-11-15
Description: In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible infinite loop leading to resource exhaustion due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835, CWE-787
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2017-13314
Published: 2024-11-15
Description: In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-276
References: https://source.android.com/security/bulletin/2018-05-01
CVE: CVE-2024-11261
Published: 2024-11-15
Description: A vulnerability, which was classified as critical, was found in SourceCodester Student Record Management System 1.0. Affected is an unknown function of the file StudentRecordManagementSystem.cpp of the component Number of Students Menu. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://github.com/Hacker0xone/CVE/issues/12; https://vuldb.com/?ctiid.284718; https://vuldb.com/?id.284718
CVE: CVE-2024-38370
Published: 2024-11-15
Description: GLPI is a free asset and IT management software package. Starting in 9.2.0 and prior to 11.0.0, it is possible to download a document from the API without appropriate rights. Upgrade to 10.0.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-xrm2-m72w-w4x4
CVE: CVE-2024-50983
Published: 2024-11-15
Description: FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user by including a malicious payload into the Last Name section in the Create/Edit Faculty/Staff User or Create/Edit Student User sections.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/redhotchilihacker1/CVE-Hunting/blob/master/CVE-2024-50983/README.md; https://github.com/swampopus/flightpath/blob/e713acf9f125af22cc68c2f5664c2869cd73616b/flightpath/CHANGELOG.txt#L4
CVE: CVE-2024-51764
Published: 2024-11-15
Description: A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04747en_us&docLocale=en_US
CVE: CVE-2024-51765
Published: 2024-11-15
Description: A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04748en_us&docLocale=en_US
CVE: CVE-2024-9500
Published: 2024-11-15
Description: A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
CVSS Score: 7.8 (HIGH)
CWE: CWE-379
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0023
CVE: CVE-2024-11262
Published: 2024-11-15
Description: A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as critical. Affected by this vulnerability is the function main of the component View All Student Marks. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Hacker0xone/CVE/issues/13; https://vuldb.com/?ctiid.284719; https://vuldb.com/?id.284719
CVE: CVE-2024-11263
Published: 2024-11-15
Description: When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-270
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jjf3-7x72-pqm9
CVE: CVE-2024-10786
Published: 2024-11-16
Description: The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.7.11/includes/class-simple-local-avatars.php#L1374; https://plugins.trac.wordpress.org/changeset/3186674/simple-local-avatars/tags/2.8.0/includes/class-simple-local-avatars.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2619d50-e295-4e13-91d4-f998b8aa5be4?source=cve
CVE: CVE-2024-10795
Published: 2024-11-16
Description: The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3185542%40popularis-extra&new=3185542%40popularis-extra&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5de554-1d2f-4932-9f93-1333b07edeba?source=cve
CVE: CVE-2024-10861
Published: 2024-11-16
Description: The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/4.9.2/admin/class-ays-pb-admin.php#L609; https://plugins.trac.wordpress.org/changeset/3188357/ays-popup-box/tags/4.9.8/admin/class-ays-pb-admin.php?old=3186262&old_path=ays-popup-box%2Ftags%2F4.9.7%2Fadmin%2Fclass-ays-pb-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3717e03-9a18-48a1-97d3-1d41c7f93261?source=cve
CVE: CVE-2024-10015
Published: 2024-11-16
Description: The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3191324%40convertcalculator%2Ftrunk&old=2877196%40convertcalculator%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/convertcalculator/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1f55b51-cc93-4f45-9666-03740e147277?source=cve
CVE: CVE-2024-10017
Published: 2024-11-16
Description: The PJW Mime Config plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/pjw-mime-config; https://www.wordfence.com/threat-intel/vulnerabilities/id/2731e8ed-27db-4d2b-b76f-8fdccfb2226a?source=cve
CVE: CVE-2024-10147
Published: 2024-11-16
Description: The Steel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/steel/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ed1ef4-8867-499b-8f73[PII_REDACTED]62?source=cve
CVE: CVE-2024-10262
Published: 2024-11-16
Description: The The Drop Shadow Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/drop-shadow-boxes/trunk/dropshadowboxes.php#L150; https://plugins.trac.wordpress.org/changeset/3199280/; https://wordpress.org/plugins/drop-shadow-boxes/#developers
CVE: CVE-2024-10533
Published: 2024-11-16
Description: The WP Chat App plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the ajax_install_plugin() function in all versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the filebird plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-whatsapp/tags/3.6.7/includes/Cross.php#L206; https://plugins.trac.wordpress.org/browser/wp-whatsapp/trunk/includes/Cross.php#L206; https://plugins.trac.wordpress.org/changeset/3186930/wp-whatsapp/trunk/includes/Cross.php