deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49689
Published: 2023-12-22
Description: Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/pollini/; https://www.kashipara.com/; https://fluidattacks.com/advisories/pollini/
CVE: CVE-2023-49690
Published: 2023-12-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-7052
Published: 2023-12-22
Description: A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_profile_notes.md; https://vuldb.com/?ctiid.248739; https://vuldb.com/?id.248739
CVE: CVE-2023-51704
Published: 2023-12-22
Description: An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00018.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/; https://phabricator.wikimedia.org/T347726
CVE: CVE-2023-51707
Published: 2023-12-22
Description: MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Attacks.pdf; https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_Command_Injection_Attacks.pdf
CVE: CVE-2023-51708
Published: 2023-12-22
Description: Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.
CVSS Score: 8.6 (HIGH)
CWE: CWE-287
References: https://www.bentley.com/advisories/be-2023-0002/; https://www.bentley.com/advisories/be-2023-0002/
CVE: CVE-2023-7053
Published: 2023-12-22
Description: A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.
CVSS Score: 3.1 (LOW)
CWE: CWE-521
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/note_weakpass.md; https://vuldb.com/?ctiid.248740; https://vuldb.com/?id.248740
CVE: CVE-2023-7054
Published: 2023-12-22
Description: A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434, CWE-79
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_malicious_fileupload.md; https://vuldb.com/?ctiid.248741; https://vuldb.com/?id.248741
CVE: CVE-2023-51713
Published: 2023-12-22
Description: make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/proftpd/proftpd/blob/1.3.8/NEWS; https://github.com/proftpd/proftpd/issues/1683; https://github.com/proftpd/proftpd/issues/1683#issuecomment[PII_REDACTED]
CVE: CVE-2023-7055
Published: 2023-12-22
Description: A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-732
References: https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_parameter_tampering.md; https://vuldb.com/?ctiid.248742; https://vuldb.com/?id.248742
CVE: CVE-2023-7056
Published: 2023-12-22
Description: A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the argument Description/Units leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248743.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1XDGcSRytGV11YWuhIuW_4GvD7kEpgjZT/view?usp=sharing; https://vuldb.com/?ctiid.248743; https://vuldb.com/?id.248743
CVE: CVE-2022-47532
Published: 2023-12-22
Description: FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://herolab.usd.de/security-advisories/usd-2022-0064/; https://herolab.usd.de/security-advisories/usd-2022-0064/
CVE: CVE-2023-24609
Published: 2023-12-22
Description: Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://www.rambus.com/security/software-protocols/tls-toolkit/; https://www.telekom.com/en/company/data-privacy-and-security/news/advisories-504842; https://www.rambus.com/security/software-protocols/tls-toolkit/
CVE: CVE-2023-7057
Published: 2023-12-22
Description: A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/file/d/1s2kLMjnUvlrD_XocoDl3-ABrWYTo5Azd/view?usp=sharing; https://vuldb.com/?ctiid.248744; https://vuldb.com/?id.248744
CVE: CVE-2023-7058
Published: 2023-12-22
Description: A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-24
References: https://github.com/laoquanshi/Simple-Student-Attendance-System; https://vuldb.com/?ctiid.248749; https://vuldb.com/?id.248749
CVE: CVE-2023-7059
Published: 2023-12-22
Description: A vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file log-book.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248750 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/school-visitors-log-e-book.md; https://vuldb.com/?ctiid.248750; https://vuldb.com/?id.248750
CVE: CVE-2023-43116
Published: 2023-12-22
Description: A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md
CVE: CVE-2023-43741
Published: 2023-12-22
Description: A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md; https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md
CVE: CVE-2023-49356
Published: 2023-12-22
Description: A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/linzc21/bug-reports/blob/main/reports/mp3gain/1.6.2/stack-buffer-overflow/CVE-2023-49356.md; https://github.com/linzc21/bug-reports/blob/main/reports/mp3gain/1.6.2/stack-buffer-overflow/CVE-2023-49356.md
CVE: CVE-2023-49391
Published: 2023-12-22
Description: An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/free5gc/free5gc/issues/497; https://github.com/free5gc/free5gc/issues/497
CVE: CVE-2023-50569
Published: 2023-12-22
Description: Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-50250. Reason: This record is a reservation duplicate of CVE-2023-50250. Notes: All CVE users should reference CVE-2023-50250 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2023-7075
Published: 2023-12-22
Description: A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Glunko/vulnerability/blob/main/Point-of-Sales-And-Inventory-Management-System.md; https://vuldb.com/?ctiid.248846; https://vuldb.com/?id.248846
CVE: CVE-2023-7076
Published: 2023-12-22
Description: A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2]['subject']/bug[2]['text']/report['subject'] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/otsoft/myaac/commit/83a91ec540072d319dd338abff45f8d5ebf48190; https://github.com/slawkens/myaac/releases/tag/v0.8.14; https://vuldb.com/?ctiid.248848
CVE: CVE-2022-39337
Published: 2023-12-22
Description: Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-863
References: https://github.com/dromara/hertzbeat/commit/ac5970c6ceb64fafe237fc895243df5f21e40876; https://github.com/dromara/hertzbeat/issues/377; https://github.com/dromara/hertzbeat/pull/382
CVE: CVE-2023-51661
Published: 2023-12-22
Description: Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.
CVSS Score: 8.4 (HIGH)
CWE: CWE-284
References: https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c; https://github.com/wasmerio/wasmer/issues/4267; https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j
CVE: CVE-2023-42017
Published: 2023-12-22
Description: IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions.  By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system.  IBM X-Force ID:  265567.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265567; https://www.ibm.com/support/pages/node/7096528; https://exchange.xforce.ibmcloud.com/vulnerabilities/265567
CVE: CVE-2023-42465
Published: 2023-12-22
Description: Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.
CVSS Score: 7.0 (HIGH)
References: https://arxiv.org/abs/2309.02545; https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f; https://github.com/sudo-project/sudo/releases/tag/SUDO_1_9_15
CVE: CVE-2023-45165
Published: 2023-12-22
Description: IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service.  IBM X-Force ID:  267963.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/267963; https://www.ibm.com/support/pages/node/7100970; https://exchange.xforce.ibmcloud.com/vulnerabilities/267963
CVE: CVE-2023-45957
Published: 2023-12-22
Description: A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/thirtybees/thirtybees/commit/f5b2c1e0094ce53fded1443bab99a604ae8e2968; https://github.com/thirtybees/thirtybees/compare/1.4.0...1.5.0; https://zigrin.com/advisories/thirty-bees-stored-cross-site-scripting-xss/
CVE: CVE-2023-48670
Published: 2023-12-22
Description: 
Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.


CVSS Score: 7.3 (HIGH)
CWE: CWE-426, CWE-426
References: https://www.dell.com/support/kbdoc/en-us/000220677/dsa-2023-468-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability; https://www.dell.com/support/kbdoc/en-us/000220677/dsa-2023-468-security-update-for-dell-supportassist-for-home-pcs-installer-file-local-privilege-escalation-vulnerability
CVE: CVE-2023-48704
Published: 2023-12-22
Description: ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
CVSS Score: 7.0 (HIGH)
CWE: CWE-120, CWE-122, CWE-787
References: https://github.com/ClickHouse/ClickHouse/pull/57107; https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63; https://github.com/ClickHouse/ClickHouse/pull/57107
CVE: CVE-2023-49085
Published: 2023-12-22
Description: Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/176995/Cacti-pollers.php-SQL-Injection-Remote-Code-Execution.html; https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/pollers.php#L451; https://github.com/Cacti/cacti/security/advisories/GHSA-vr3c-38wh-g855
CVE: CVE-2023-49088
Published: 2023-12-22
Description: Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/data_debug.php; https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h; https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x
CVE: CVE-2023-49790
Published: 2023-12-22
Description: The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/nextcloud/ios/pull/2665; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggv; https://hackerone.com/reports/2245437
CVE: CVE-2023-49791
Published: 2023-12-22
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284, CWE-287
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f8p-6qww-2prr; https://github.com/nextcloud/server/pull/41520; https://hackerone.com/reports/2120667
CVE: CVE-2023-49792
Published: 2023-12-22
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5j2p-q736-hw98; https://github.com/nextcloud/server/pull/41526; https://hackerone.com/reports/2230915
CVE: CVE-2023-50250
Published: 2023-12-22
Description: Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Cacti/cacti/blob/5f6f65c215d663a775950b2d9db35edbaf07d680/templates_import.php; https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/