deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-27021
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

r8169: fix LED-related deadlock on module removal

Binding devm_led_classdev_register() to the netdev is problematic
because on module removal we get a RTNL-related deadlock. Fix this
by avoiding the device-managed LED functions.

Note: We can safely call led_classdev_unregister() for a LED even
if registering it failed, because led_classdev_unregister() detects
this and is a no-op in this case.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/19fa4f2a85d777a8052e869c1b892a2f7556569d; https://git.kernel.org/stable/c/53d986f39acd8ea11c9e460732bfa5add66360d9; https://git.kernel.org/stable/c/19fa4f2a85d777a8052e869c1b892a2f7556569d
CVE: CVE-2024-27022
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

fork: defer linking file vma until vma is fully initialized

Thorvald reported a WARNING [1]. And the root cause is below race:

 CPU 1					CPU 2
 fork					hugetlbfs_fallocate
  dup_mmap				 hugetlbfs_punch_hole
   i_mmap_lock_write(mapping);
   vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.
   i_mmap_unlock_write(mapping);
   hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!
					 i_mmap_lock_write(mapping);
   					 hugetlb_vmdelete_list
					  vma_interval_tree_foreach
					   hugetlb_vma_trylock_write -- Vma_lock is cleared.
   tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem!
					   hugetlb_vma_unlock_write -- Vma_lock is assigned!!!
					 i_mmap_unlock_write(mapping);

hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside
i_mmap_rwsem lock while vma lock can be used in the same time.  Fix this
by deferring linking file vma until vma is fully initialized.  Those vmas
should be initialized first before they can be used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-908
References: https://git.kernel.org/stable/c/2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b; https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19; https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34
CVE: CVE-2024-32966
Published: 2024-05-01
Description: Static Web Server (SWS) is a tiny and fast production-ready web server suitable to serve static web files or assets. In affected versions if directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like `<img src=x onerror=alert(1)>.txt` will allow JavaScript code execution in the context of the web server’s domain. SWS generally does not perform escaping of HTML entities on any values inserted in the directory listing. At the very least `file_name` and `current_path` could contain malicious data however. `file_uri` could also be malicious but the relevant scenarios seem to be all caught by hyper. For any web server that allow users to upload files or create directories under a name of their choosing this becomes a stored Cross-site Scripting vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg; https://github.com/static-web-server/static-web-server/security/advisories/GHSA-rwfq-v4hq-h7fg
CVE: CVE-2024-3591
Published: 2024-05-01
Description: The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/; https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/
CVE: CVE-2024-23335
Published: 2024-05-01
Description: MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch; https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r; https://mybb.com/versions/1.8.38
CVE: CVE-2024-23336
Published: 2024-05-01
Description: MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-184, CWE-918
References: https://docs.mybb.com/1.8/administration/configuration-file; https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630; https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h
CVE: CVE-2024-31225
Published: 2024-05-01
Description: RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The `_on_rd_init()` function does not implement a size check before copying data to the `_result_buf` static buffer. If an attacker can craft a long enough payload, they could cause a buffer overflow. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution. This issue has yet to be patched. Users are advised to add manual bounds checking.
CVSS Score: 8.3 (HIGH)
CWE: CWE-120
References: http://seclists.org/fulldisclosure/2024/May/7; http://www.openwall.com/lists/oss-security/2024/05/07/3; https://github.com/RIOT-OS/RIOT/blob/master/sys/net/application_layer/cord/lc/cord_lc.c#L218
CVE: CVE-2024-32017
Published: 2024-05-01
Description: RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. The size check in the `gcoap_dns_server_proxy_get()` function contains a small typo that may lead to a buffer overflow in the subsequent `strcpy()`. In detail, the length of the `_uri` string is checked instead of the length of the `_proxy` string. The `_gcoap_forward_proxy_copy_options()` function does not implement an explicit size check before copying data to the `cep->req_etag` buffer that is `COAP_ETAG_LENGTH_MAX` bytes long. If an attacker can craft input so that `optlen` becomes larger than `COAP_ETAG_LENGTH_MAX`, they can cause a buffer overflow. If the input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerabilities could range from denial of service to arbitrary code execution. This issue has yet to be patched. Users are advised to add manual bounds checking.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://seclists.org/fulldisclosure/2024/May/7; http://www.openwall.com/lists/oss-security/2024/05/07/3; https://github.com/RIOT-OS/RIOT/blob/master/sys/net/application_layer/gcoap/dns.c#L319-L325
CVE: CVE-2024-32018
Published: 2024-05-01
Description: RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. Most codebases define assertion macros which compile to a no-op on non-debug builds. If assertions are the only line of defense against untrusted input, the software may be exposed to attacks that leverage the lack of proper input checks. In detail, in the `nimble_scanlist_update()` function below, `len` is checked in an assertion and subsequently used in a call to `memcpy()`. If an attacker is able to provide a larger `len` value while assertions are compiled-out, they can write past the end of the fixed-length `e->ad` buffer. If the unchecked input above is attacker-controlled and crosses a security boundary, the impact of the buffer overflow vulnerability could range from denial of service to arbitrary code execution. This issue has not yet been patched. Users are advised to add manual `len` checking.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://seclists.org/fulldisclosure/2024/May/7; http://www.openwall.com/lists/oss-security/2024/05/07/3; https://github.com/RIOT-OS/RIOT/blob/master/pkg/nimble/scanlist/nimble_scanlist.c#L74-L87
CVE: CVE-2024-32890
Published: 2024-05-01
Description: librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) and returned in the JSON API (`results/json.php`). This vulnerability has been introduced in commit 3937b94. This vulnerability affects LibreSpeed speedtest instances running version 5.2.5 or higher which have telemetry enabled and has been addressed in version 5.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/librespeed/speedtest/commit/3937b940e80b734acae36cd41a2a31819593e728; https://github.com/librespeed/speedtest/commit/dd1ce2cb8830d94dcaa0b8e70b9406144a0e5f8d; https://github.com/librespeed/speedtest/security/advisories/GHSA-3954-xrwh-fq4q
CVE: CVE-2024-32963
Published: 2024-05-01
Description: Navidrome is an open source web-based music collection server and streamer. In affected versions of Navidrome are subject to a parameter tampering vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist, added song, posted arbitrary comment, set the playlist to be public, and put the admin as the owner of the playlist. The attacker must be able to intercept http traffic for this attack. Each known user is impacted. An attacker can obtain the ownerId from shared playlist information, meaning every user who has shared a playlist is also impacted, as they can be impersonated. This issue has been addressed in version 0.52.0 and users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://github.com/navidrome/navidrome/security/advisories/GHSA-4jrx-5w4h-3gpm; https://github.com/navidrome/navidrome/security/advisories/GHSA-4jrx-5w4h-3gpm
CVE: CVE-2024-32967
Published: 2024-05-01
Description: Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6; https://github.com/zitadel/zitadel/releases/tag/v2.45.7; https://github.com/zitadel/zitadel/releases/tag/v2.46.7
CVE: CVE-2024-32973
Published: 2024-05-01
Description: Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session. This results in the HTTP library and socket.starttls providing less transport integrity than expected. This issue has been patched in pull request #851 which has been included in version 0.9.3. Users are advised to upgrade. there are no known workarounds for this vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-284
References: https://github.com/PlutoLang/Pluto/pull/851; https://github.com/PlutoLang/Pluto/security/advisories/GHSA-84hj-7j2v-w665; https://github.com/PlutoLang/Pluto/pull/851
CVE: CVE-2024-32979
Published: 2024-05-01
Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. It was discovered that due to improper handling and escaping of user-provided query parameters, a maliciously crafted Nautobot URL could potentially be used to execute a Reflected Cross-Site Scripting (Reflected XSS) attack against users. All filterable object-list views in Nautobot are vulnerable. This issue has been fixed in Nautobot versions 1.6.20 and 2.2.3. There are no known workarounds for this vulnerability.

CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/nautobot/nautobot/commit/42440ebd9b381534ad89d62420ebea00d703d64e; https://github.com/nautobot/nautobot/pull/5646; https://github.com/nautobot/nautobot/pull/5647
CVE: CVE-2024-32984
Published: 2024-05-01
Description: Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. The Rust implementation of the Yamux stream multiplexer uses a vector for pending frames. This vector is not bounded in length. Every time the Yamux protocol requires sending of a new frame, this frame gets appended to this vector. This can be remotely triggered in a number of ways, for example by: 1. Opening a new libp2p Identify stream. This causes the node to send its Identify message. Of course, every other protocol that causes the sending of data also works. The larger the response, the more data is enqueued. 2. Sending a Yamux Ping frame. This causes a Pong frame to be enqueued. Under normal circumstances, this queue of pending frames would be drained once they’re sent out over the network. However, the attacker can use TCP’s receive window mechanism to prevent the victim from sending out any data: By not reading from the TCP connection, the receive window will never be increased, and the victim won’t be able to send out any new data (this is how TCP implements backpressure). Once this happens, Yamux’s queue of pending frames will start growing indefinitely. The queue will only be drained once the underlying TCP connection is closed. An attacker can cause a remote node to run out of memory, which will result in the corresponding process getting terminated by the operating system.

CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/libp2p/rust-yamux/blob/yamux-v0.13.1/yamux/src/connection.rs#L289; https://github.com/libp2p/rust-yamux/security/advisories/GHSA-3999-5ffv-wp2r; https://github.com/sigp/rust-yamux/commit/6689e227a48258a52347cd1d984adfc94afc6f7a
CVE: CVE-2024-33835
Published: 2024-05-01
Description: Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://github.com/isBigChen/iot/blob/main/tenda/formSetSafeWanWebMan.md; https://github.com/isBigChen/iot/blob/main/tenda/formSetSafeWanWebMan.md
CVE: CVE-2022-38386
Published: 2024-05-01
Description: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques.  IBM X-Force ID:  233778.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-1275
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/233778; https://www.ibm.com/support/pages/node/7149811; https://exchange.xforce.ibmcloud.com/vulnerabilities/233778
CVE: CVE-2022-48669
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Fix potential memleak in papr_get_attr()

`buf` is allocated in papr_get_attr(), and krealloc() of `buf`
could fail. We need to free the original `buf` in the case of failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1699fb915b9f61794d559b55114c09a390aaf234; https://git.kernel.org/stable/c/7f7d39fe3d80d[PII_REDACTED]b2413010cf6527029; https://git.kernel.org/stable/c/a3f22feb2220a945d1c3282e34199e8bcdc5afc4
CVE: CVE-2023-52649
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vkms: Avoid reading beyond LUT array

When the floor LUT index (drm_fixp2int(lut_index) is the last
index of the array the ceil LUT index will point to an entry
beyond the array. Make sure we guard against it and use the
value of the floor LUT index.

v3:
 - Drop bits from commit description that didn't contribute
   anything of value
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/046c1184ce60b0a37d48134f17ddbc1f32ce02bd; https://git.kernel.org/stable/c/2fee84030d12d9fddfa874e4562d71761a129277; https://git.kernel.org/stable/c/92800aaeff51b8358d1e0a7eb74daf8aa2d7ce9d
CVE: CVE-2023-52650
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: dsi: Add missing check for of_find_device_by_node

Add check for the return value of of_find_device_by_node() and return
the error if it fails in order to avoid NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3169eaf1365541fd8e521091010c44fbe14691fc; https://git.kernel.org/stable/c/47a13d0b9d[PII_REDACTED]ab5c39667f69d6203e80; https://git.kernel.org/stable/c/50c0ad785a780c72a2fdaba10b38c645ffb4eae6
CVE: CVE-2023-52651
Published: 2024-05-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52652
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

NTB: fix possible name leak in ntb_register_device()

If device_register() fails in ntb_register_device(), the device name
allocated by dev_set_name() should be freed. As per the comment in
device_register(), callers should use put_device() to give up the
reference in the error path. So fix this by calling put_device() in the
error path so that the name can be freed in kobject_cleanup().

As a result of this, put_device() in the error path of
ntb_register_device() is removed and the actual error is returned.

[mani: reworded commit message]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6632a54ac8057cc0b0d789c6f73883e871bcd25c; https://git.kernel.org/stable/c/913421f9f7fd8324dcc41753d0f28b52e177ef04; https://git.kernel.org/stable/c/a039690d323221eb5865f1f31db3ec264e7a14b6
CVE: CVE-2023-52653
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix a memleak in gss_import_v2_context

The ctx->mech_used.data allocated by kmemdup is not freed in neither
gss_import_v2_context nor it only caller gss_krb5_import_sec_context,
which frees ctx on error.

Thus, this patch reform the last call of gss_import_v2_context to the
gss_krb5_import_ctx_v2, preventing the memleak while keepping the return
formation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/47ac11db93e74ac49cd6c3fc69bcbc5964c4a8b4; https://git.kernel.org/stable/c/99044c01ed5329e73651c054d8a4baacdbb1a27c; https://git.kernel.org/stable/c/d111e30d9cd846bb368faf3637dc0f71fcbcf822
CVE: CVE-2024-0334
Published: 2024-05-01
Description: The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attribute of a link in several Elementor widgets in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3077328/jeg-elementor-kit; https://www.wordfence.com/threat-intel/vulnerabilities/id/950e9042-1364-4200-8f57[PII_REDACTED]64?source=cve; https://plugins.trac.wordpress.org/changeset/3077328/jeg-elementor-kit
CVE: CVE-2024-23597
Published: 2024-05-01
Description: Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. If a logged-in user of TVRock accesses a specially crafted page, unintended operations may be performed. Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN24683352/; https://jvn.jp/en/jp/JVN24683352/
CVE: CVE-2024-24978
Published: 2024-05-01
Description: Denial-of-service (DoS) vulnerability exists in TvRock 0.9t8a. Receiving a specially crafted request by a remote attacker or having a user of TvRock click a specially crafted request may lead to ABEND (abnormal end). Note that the developer was unreachable, therefore, users should consider stop using TvRock 0.9t8a.
CVSS Score: 4.3 (MEDIUM)
References: https://jvn.jp/en/jp/JVN40079147/; https://jvn.jp/en/jp/JVN40079147/
CVE: CVE-2024-27023
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

md: Fix missing release of 'active_io' for flush

submit_flushes
 atomic_set(&mddev->flush_pending, 1);
 rdev_for_each_rcu(rdev, mddev)
  atomic_inc(&mddev->flush_pending);
  bi->bi_end_io = md_end_flush
  submit_bio(bi);
                        /* flush io is done first */
                        md_end_flush
                         if (atomic_dec_and_test(&mddev->flush_pending))
                          percpu_ref_put(&mddev->active_io)
                          -> active_io is not released

 if (atomic_dec_and_test(&mddev->flush_pending))
  -> missing release of active_io

For consequence, mddev_suspend() will wait for 'active_io' to be zero
forever.

Fix this problem by releasing 'active_io' in submit_flushes() if
'flush_pending' is decreased to zero.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/02dad157ba11064d073f5499dc33552b227d5d3a; https://git.kernel.org/stable/c/11f81438927f84edfaaeb5d5f10856c3a1c1fc82; https://git.kernel.org/stable/c/6b2ff10390b19a2364af622b6666b690443f9f3f
CVE: CVE-2024-27024
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix WARNING in rds_conn_connect_if_down

If connection isn't established yet, get_mr() will fail, trigger connection after
get_mr().
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/2b505d05280739ce31d5708da840f42df827cb85; https://git.kernel.org/stable/c/[PII_REDACTED]57751bc08eb26f1b02e97c1631c8f4; https://git.kernel.org/stable/c/[PII_REDACTED]69adecb02461a14120e9a1812a5fb1
CVE: CVE-2024-27025
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

nbd: null check for nla_nest_start

nla_nest_start() may fail and return NULL. Insert a check and set errno
based on other call sites within the same source code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d; https://git.kernel.org/stable/c/44214d744be32a4769faebba764510888f1eb19e; https://git.kernel.org/stable/c/4af837db0fd3679fabc7b[PII_REDACTED]b0c06dced