deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31224
Published: 2024-04-08
Description: GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/binary-husky/gpt_academic/commit/8af6c0cab6d96f5c4520bec85b24802e6e823f35; https://github.com/binary-husky/gpt_academic/pull/1648; https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-jcjc-89wr-vv7g
CVE: CVE-2024-31442
Published: 2024-04-08
Description: Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command is `/products admin clear` as this was already programmed for bot owners only. All users should upgrade to version 1.0.2 to receive a patch.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd; https://github.com/Redon-Tech/Redon-Hub/security/advisories/GHSA-3rx8-6453-7q26; https://github.com/Redon-Tech/Redon-Hub/commit/38cb7c08d4d890e8a1badadbd46f459f06e3cdcd
CVE: CVE-2024-31447
Published: 2024-04-08
Description: Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77; https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3; https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7
CVE: CVE-2024-3445
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /karyawan/laporan_filter. The manipulation of the argument data_karyawan leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259702 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL.md; https://vuldb.com/?ctiid.259702; https://vuldb.com/?id.259702
CVE: CVE-2024-3455
Published: 2024-04-08
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add_postlogin.php. The manipulation of the argument SingleLoginId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259711.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-add_postlogin.md; https://vuldb.com/?ctiid.259711; https://vuldb.com/?id.259711
CVE: CVE-2024-3456
Published: 2024-04-08
Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/config_Anticrack.php. The manipulation of the argument GroupId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259712.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-config_Anticrack.md; https://vuldb.com/?ctiid.259712; https://vuldb.com/?id.259712
CVE: CVE-2023-7164
Published: 2024-04-08
Description: The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-91a1e5bf112e/; https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-91a1e5bf112e/
CVE: CVE-2024-23082
Published: 2024-04-08
Description: ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
References: http://threeten.com; https://gist.github.com/LLM4IG/d2618f5f4e5ac37eb75cff5617e58b90; https://github.com/ThreeTen/threetenbp
CVE: CVE-2024-3457
Published: 2024-04-08
Description: A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259713 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-nconfig_ISCGroupNoCache.md; https://vuldb.com/?ctiid.259713; https://vuldb.com/?id.259713
CVE: CVE-2024-3458
Published: 2024-04-08
Description: A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_ikev2.md; https://vuldb.com/?ctiid.259714; https://vuldb.com/?id.259714
CVE: CVE-2024-28224
Published: 2024-04-08
Description: Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-346
References: https://github.com/ollama/ollama/releases; https://research.nccgroup.com/2024/04/08/technical-advisory-ollama-dns-rebinding-attack-cve-2024-28224/; https://www.nccgroup.trust/us/our-research/?research=Technical+advisories
CVE: CVE-2024-28270
Published: 2024-04-08
Description: An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
CVSS Score: 8.1 (HIGH)
CWE: CWE-261
References: https://github.com/bcvgh/web-flash-Broken-Access-Control-vulnerability/; https://github.com/bcvgh/web-flash-Broken-Access-Control-vulnerability/
CVE: CVE-2024-23078
Published: 2024-04-08
Description: JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-476
References: http://jgrapht.com; https://gist.github.com/LLM4IG/5feabadf06a88102df316174123e2770; https://github.com/jgrapht/jgrapht
CVE: CVE-2024-23085
Published: 2024-04-08
Description: Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double[], int, int[]). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-690
References: http://apfloat.com; https://gist.github.com/LLM4IG/a4a54fc4abe044976a66af9fffedfc94; https://github.com/mtommila/apfloat
CVE: CVE-2024-23086
Published: 2024-04-08
Description: Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://apfloat.com; https://gist.github.com/LLM4IG/63ad1a4d1e3955043b7a90fdbf36676b; https://github.com/mtommila/apfloat
CVE: CVE-2024-24279
Published: 2024-04-08
Description: An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-261, CWE-287
References: https://github.com/BossSecuLab/Vulnerability_Reporting/security/advisories/GHSA-9fj6-vr9p-px49; https://github.com/BossSecuLab/Vulnerability_Reporting/security/advisories/GHSA-9fj6-vr9p-px49
CVE: CVE-2024-3463
Published: 2024-04-08
Description: A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /karyawan/edit. The manipulation of the argument karyawan leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259744.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemXSS.md; https://vuldb.com/?ctiid.259744; https://vuldb.com/?id.259744
CVE: CVE-2024-3464
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the file /application/controller/Pelanggan.php. The manipulation of the argument jeniskelamin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259745 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL2.md; https://vuldb.com/?ctiid.259745; https://vuldb.com/?id.259745
CVE: CVE-2024-27630
Published: 2024-04-08
Description: Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://github.com/ally-petitt/CVE-2024-27630; https://medium.com/%40allypetitt/how-i-found-3-cves-in-2-days-8a135eb924d3; https://github.com/ally-petitt/CVE-2024-27630
CVE: CVE-2024-27631
Published: 2024-04-08
Description: Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: https://git.savannah.nongnu.org/cgit/administration/savane.git/commit/?h=i18n&id=d3962d3feb75467489b869204db98e2dffaaaf09; https://github.com/ally-petitt/CVE-2024-27631; https://medium.com/%40allypetitt/how-i-found-3-cves-in-2-days-8a135eb924d3
CVE: CVE-2024-3465
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the file /application/controller/Transaki.php. The manipulation of the argument dari/sampai leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259746 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL3.md; https://vuldb.com/?ctiid.259746; https://vuldb.com/?id.259746
CVE: CVE-2024-3466
Published: 2024-04-08
Description: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function laporan_filter of the file /application/controller/Pengeluaran.php. The manipulation of the argument dari/sampai leads to sql injection. The associated identifier of this vulnerability is VDB-259747.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL4.md; https://vuldb.com/?ctiid.259747; https://vuldb.com/?id.259747
CVE: CVE-2024-0082
Published: 2024-04-08
Description: NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause improper privilege management by sending open file requests to the application. A successful exploit of this vulnerability might lead to local escalation of privileges, information disclosure, and data tampering
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5532; https://nvidia.custhelp.com/app/answers/detail/a_id/5532
CVE: CVE-2024-0083
Published: 2024-04-08
Description: NVIDIA ChatRTX for Windows contains a vulnerability in the UI, where an attacker can cause a cross-site scripting error by network by running malicious scripts in users' browsers. A successful exploit of this vulnerability might lead to code execution, denial of service, and information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5532; https://nvidia.custhelp.com/app/answers/detail/a_id/5532
CVE: CVE-2024-27632
Published: 2024-04-08
Description: An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-335
References: https://github.com/ally-petitt/CVE-2024-27632; https://medium.com/%40allypetitt/how-i-found-3-cves-in-2-days-8a135eb924d3; https://github.com/ally-petitt/CVE-2024-27632
CVE: CVE-2024-22949
Published: 2024-04-08
Description: JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://jfreechart.com; https://gist.github.com/LLM4IG/35c46e009b205ef6acd0e290e80fb876; https://github.com/jfree/jfreechart
CVE: CVE-2024-23079
Published: 2024-04-08
Description: JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: http://jgrapht.com; https://gist.github.com/LLM4IG/c[PII_REDACTED]cd0a400d2150fb83d079; https://github.com/jgrapht/jgrapht
CVE: CVE-2024-23081
Published: 2024-04-08
Description: ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 3.3 (LOW)
CWE: CWE-476
References: http://threeten.com; https://gist.github.com/LLM4IG/3cc9183dcd887020368a0bafeafec5e3; https://github.com/ThreeTen/threetenbp
CVE: CVE-2024-23084
Published: 2024-04-08
Description: Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: http://apfloat.com; https://gist.github.com/LLM4IG/5b7dd0a87db14d9c95d4c0ea62e0195b; https://github.com/mtommila/apfloat
CVE: CVE-2024-23584
Published: 2024-04-08
Description: The NMAP Importer service​ may expose data store credentials to authorized users of the Windows Registry.

CVSS Score: 6.6 (MEDIUM)
CWE: CWE-312
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112264; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112264
CVE: CVE-2024-31047
Published: 2024-04-08
Description: An issue in Academy Software Foundation openexr v.3.2.3 and before allows a local attacker to cause a denial of service (DoS) via the convert function of exrmultipart.cpp.
CVSS Score: 3.3 (LOW)
CWE: CWE-190
References: https://github.com/AcademySoftwareFoundation/openexr/issues/1680; https://github.com/AcademySoftwareFoundation/openexr/issues/1680
CVE: CVE-2024-25646
Published: 2024-04-09
Description: Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application.
CVSS Score: 7.7 (HIGH)
CWE: CWE-732
References: https://me.sap.com/notes/3421384; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3421384
CVE: CVE-2024-27898
Published: 2024-04-09
Description: SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://me.sap.com/notes/3425188; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3425188
CVE: CVE-2024-27899
Published: 2024-04-09
Description: Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.


CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://me.sap.com/notes/3434839; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3434839
CVE: CVE-2024-27901
Published: 2024-04-09
Description: SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.


CVSS Score: 7.2 (HIGH)
CWE: CWE-35
References: https://me.sap.com/notes/3438234; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3438234
CVE: CVE-2024-27983
Published: 2024-04-09
Description: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVSS Score: 8.2 (HIGH)
CWE: CWE-362
References: http://www.openwall.com/lists/oss-security/2024/04/03/16; https://hackerone.com/reports/2319584; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
CVE: CVE-2024-28167
Published: 2024-04-09
Description: SAP Group Reporting Data Collection does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, specific data can be changed via the Enter Package Data app although the user does not have sufficient authorization causing high impact on Integrity of the appliction.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3442378; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3442378
CVE: CVE-2024-2975
Published: 2024-04-09
Description: A race condition was identified through which privilege escalation was possible in certain configurations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1223
References: https://advisories.octopus.com/post/2024/sa2024-01/; https://advisories.octopus.com/post/2024/sa2024-01/
CVE: CVE-2024-30214
Published: 2024-04-09
Description: The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3421453; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3421453
CVE: CVE-2024-30215
Published: 2024-04-09
Description: The Resource Settings page allows a high privilege attacker to load exploitable payload to be stored and reflected whenever a User visits the page. In a successful attack, some information could be obtained and/or modified. However, the attacker does not have control over what information is obtained, or the amount or kind of loss is limited.


CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3421453; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3421453
CVE: CVE-2024-30216
Published: 2024-04-09
Description: Cash Management in SAP S/4 HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, attacker can add notes in the review request with 'completed' status affecting the integrity of the application. Confidentiality and Availability are not impacted.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3427178; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364; https://me.sap.com/notes/3427178