deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-55949
Published: 2024-12-16
Description: MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately.
CWE: CWE-269
References: https://github.com/minio/minio/commit/580d9db85e04f1b63cc2909af50f0ed08afa965f; https://github.com/minio/minio/commit/f246c9053f9603e610d98439799bdd2a6b293427; https://github.com/minio/minio/pull/20756
CVE: CVE-2024-55951
Published: 2024-12-16
Description: Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There are no workarounds for this issue aside from upgrading.
CWE: CWE-200
References: https://downloads.metabase.com/v0.52.2.5/metabase.jar; https://github.com/metabase/metabase/security/advisories/GHSA-rhjf-q2qw-rvx3; https://hub.docker.com/r/metabase/metabase/tags
CVE: CVE-2024-55100
Published: 2024-12-16
Description: A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55100-Online-Nurse-Hiring-System-v1.0-Stored-Cross-Site-Scripting-Vulnerability.md; https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/; https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55100-Online-Nurse-Hiring-System-v1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE: CVE-2024-55103
Published: 2024-12-16
Description: Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55103-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md; https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/; https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55103-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2024-55104
Published: 2024-12-16
Description: Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55104-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md; https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/; https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55104-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md
CVE: CVE-2024-55557
Published: 2024-12-16
Description: ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://apps.microsoft.com/detail/9nhtv46lg4nh?hl=en-us&gl=US; https://github.com/nroduit/Weasis/releases/tag/v4.5.1; https://github.com/partywavesec/CVE-2024-55557
CVE: CVE-2024-29671
Published: 2024-12-16
Description: Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://ez-net.co.kr/new_2012/customer/download_view.php?cid=&sid=&goods=&cate=&q=Ax1500&seq=228; https://gist.github.com/laskdjlaskdj12/4afc8b5d75640bd28eaf32de3ceda48a; https://github.com/laskdjlaskdj12/CVE-2024-29671-POC
CVE: CVE-2024-37773
Published: 2024-12-16
Description: An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-94
References: http://dctrack.com; https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE: CVE-2024-37774
Published: 2024-12-16
Description: A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://dctrack.com; https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE: CVE-2024-37775
Published: 2024-12-16
Description: Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: http://dctrack.com; https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE: CVE-2024-37776
Published: 2024-12-16
Description: A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in some admin screens.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://dctrack.com; https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE: CVE-2024-52949
Published: 2024-12-16
Description: iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible to overflow memory on the stack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/iptraf-ng/iptraf-ng/releases/tag/v1.2.1; https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-55554
Published: 2024-12-16
Description: Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security.intrexx.com/en/security-advisories/ixsa-20241204-01/
CVE: CVE-2024-12443
Published: 2024-12-16
Description: The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/support-x/trunk/support-x.php#L210; https://plugins.trac.wordpress.org/changeset/3207849/support-x/trunk/support-x.php; https://wordpress.org/plugins/support-x
CVE: CVE-2024-35230
Published: 2024-12-16
Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. In affected versions the welcome and about page includes version and revision information about the software in use (including library and components used). This information is sensitive from a security point of view because it allows software used by the server to be easily identified. This issue has been patched in version 2.26.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/geoserver/geoserver/commit/74fdab745a5deff20ac99abca24d8695fe1a52f8; https://github.com/geoserver/geoserver/commit/8cd1590a604a10875de67b04995f1952f631f920; https://github.com/geoserver/geoserver/security/advisories/GHSA-6pfc-w86r-54q6
CVE: CVE-2024-55085
Published: 2024-12-16
Description: GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://getsimple-ce.ovh/; https://tasteful-stamp-da4.notion.site/CVE-2024-55085-15b1e0f227cb80a5aee6faeb820bf7e6
CVE: CVE-2024-55451
Published: 2024-12-16
Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. The vulnerability arises from insufficient sanitization of embedded attributes in uploaded SVG files. When a maliciously crafted SVG file is viewed by other backend users, it allows authenticated attackers to execute arbitrary JavaScript in the context of other backend users' browsers, potentially leading to the theft of sensitive tokens.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md; https://github.com/dromara/ujcms; https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/StoredXSS-SVGUpload.md
CVE: CVE-2024-55452
Published: 2024-12-16
Description: A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulnerability allows authenticated attackers to redirect unprivileged users to an arbitrary, attacker-controlled webpage. When an authenticated user clicks on the malicious block item, they are redirected to the arbitrary untrusted domains, where sensitive tokens, such as JSON Web Tokens, can be stolen via a crafted webpage.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/OpenRedirect-BlockItemUpload.md; https://github.com/dromara/ujcms
CVE: CVE-2024-56017
Published: 2024-12-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/stop-registration-spam/vulnerability/wordpress-stop-registration-spam-plugin-1-23-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11900
Published: 2024-12-17
Description: The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/portfolio-pro/trunk/public/class-portfolio-pro-public.php#L358; https://www.wordfence.com/threat-intel/vulnerabilities/id/1989fe85-5c32-4671-bd20-f9d05cb5034c?source=cve
CVE: CVE-2024-11902
Published: 2024-12-17
Description: The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and including, 4.2.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208650%40slope-widgets&new=3208650%40slope-widgets&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209792%40slope-widgets&new=3209792%40slope-widgets&sfp_email=&sfph_mail=; https://wordpress.org/plugins/slope-widgets/
CVE: CVE-2024-11905
Published: 2024-12-17
Description: The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/animated-counters/trunk/animated-counters.php#L32; https://wordpress.org/plugins/animated-counters/; https://www.wordfence.com/threat-intel/vulnerabilities/id/afd2f09c-4bd5-47a5-8d4f-7345aa8925f8?source=cve
CVE: CVE-2024-11906
Published: 2024-12-17
Description: The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/tpg-get-posts/trunk/inc/class-tpg-gp-process.php#L478; https://wordpress.org/plugins/tpg-get-posts/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c22288e6-76f3-4c5a-bd7b-30681334bab7?source=cve
CVE: CVE-2024-10205
Published: 2024-12-17
Description: Authentication Bypass
vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hitachi Infrastructure Analytics Advisor on Linux, 64 bit (Hitachi Data Center Analytics 

component

).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.3-00; Hitachi Infrastructure Analytics Advisor: from 2.1.0-00 through 4.4.0-00.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-151/index.html
CVE: CVE-2020-12484
Published: 2024-12-17
Description: When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-306
References: https://www.vivo.com/en/support/security-advisory-detail?id=3
CVE: CVE-2020-12487
Published: 2024-12-17
Description: Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20
References: https://www.vivo.com/en/support/security-advisory-detail?id=4
CVE: CVE-2021-26278
Published: 2024-12-17
Description: The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-306
References: https://www.vivo.com/en/support/security-advisory-detail?id=7
CVE: CVE-2024-12239
Published: 2024-12-17
Description: The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, and including, 1.3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/powerpack-addon-for-beaver-builder/trunk/includes/admin-settings-templates.php#L62; https://www.wordfence.com/threat-intel/vulnerabilities/id/5138ed4c-3e9c-45da-917e-e8d8396a62f1?source=cve
CVE: CVE-2021-26279
Published: 2024-12-17
Description: Some parameters of the weather module are improperly stored, leaking some sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://www.vivo.com/en/support/security-advisory-detail?id=10
CVE: CVE-2024-12356
Published: 2024-12-17
Description: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://nvd.nist.gov/vuln/detail/CVE-2024-12356; https://www.beyondtrust.com/trust-center/security-advisories/bt24-10; https://www.cve.org/CVERecord?id=CVE-2024-12356
CVE: CVE-2024-55864
Published: 2024-12-17
Description: Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU90748215/; https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1/; https://wordpress.org/plugins/my-wp/#developers
CVE: CVE-2024-38499
Published: 2024-12-17
Description: CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-276
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25284; http://seclists.org/fulldisclosure/2024/Dec/16
CVE: CVE-2024-54125
Published: 2024-12-17
Description: Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
CVSS Score: 3.3 (LOW)
CWE: CWE-939
References: https://jvn.jp/en/jp/JVN08430039/; https://shonenjumpplus.com/article/info20241216
CVE: CVE-2024-9624
Published: 2024-12-17
Description: The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.
CVSS Score: 7.6 (HIGH)
CWE: CWE-918
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve; https://www.wpallimport.com
CVE: CVE-2021-26280
Published: 2024-12-17
Description: Locally installed application can bypass the permission check and perform system operations that require permission.
CVSS Score: 7.9 (HIGH)
CWE: CWE-306
References: https://www.vivo.com/en/support/security-advisory-detail?id=6
CVE: CVE-2021-26281
Published: 2024-12-17
Description: Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.vivo.com/en/support/security-advisory-detail?id=9
CVE: CVE-2024-11999
Published: 2024-12-17
Description: CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete
control of the device when an authenticated user installs malicious code into HMI product.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1104
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-02.pdf
CVE: CVE-2024-12219
Published: 2024-12-17
Description: The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-56017 is likely a duplicate of this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3206562/; https://wordpress.org/plugins/stop-registration-spam/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5fb4ac-f86e-4b5e-ad4b-be19158ab745?source=cve
CVE: CVE-2024-12220
Published: 2024-12-17
Description: The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3207316/; https://wordpress.org/plugins/wc-sms/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/35707e4e-ca67-43fe-b120-79101ef31155?source=cve
CVE: CVE-2024-11294
Published: 2024-12-17
Description: The Memberful plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.73.9 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as site members.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3204895/memberful-wp; https://www.wordfence.com/threat-intel/vulnerabilities/id/19ad787d-e027-48f5-8b5f-9263338b4fc3?source=cve
CVE: CVE-2024-12293
Published: 2024-12-17
Description: The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the update_roles() function. This makes it possible for unauthenticated attackers to add or remove roles for arbitrary users, including escalating their privileges to administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/user-role-editor/trunk/includes/classes/grant-roles.php#L184; https://plugins.trac.wordpress.org/browser/user-role-editor/trunk/includes/classes/grant-roles.php#L187; https://plugins.trac.wordpress.org/changeset/3208193/