deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-36539
Published: 2022-09-07
Description: WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://apps.apple.com/nl/app/eigen-wijzer-ouderapp/id[PII_REDACTED]; https://github.com/Fopje/CVE-2022-36539; https://apps.apple.com/nl/app/eigen-wijzer-ouderapp/id[PII_REDACTED]
CVE: CVE-2022-36587
Published: 2022-09-07
Description: In Tenda G3 US_G3V3.0br_V15.11.0.6(7663)_EN_TDE, there is a buffer overflow vulnerability caused by sprintf in function in the httpd binary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-%200x53208.md; https://www.tendacn.com/download/detail-3401.html; https://github.com/Davidteeri/Bug-Report/blob/main/tenda-G3-%200x53208.md
CVE: CVE-2022-36659
Published: 2022-09-07
Description: xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_write(). This vulnerability allows attackers to cause a Denial of Service via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html; https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html
CVE: CVE-2022-36660
Published: 2022-09-07
Description: xhyve commit dfbe09b was discovered to contain a stack buffer overflow via the component pci_vtrnd_notify().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html; https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html
CVE: CVE-2022-36661
Published: 2022-09-07
Description: xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vi_pci_read(). This vulnerability allows attackers to cause a Denial of Service via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html; https://awxylitol.github.io/2022/07/21/disclose-three-bugs-in-xhyve.html
CVE: CVE-2022-37780
Published: 2022-09-07
Description: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution (RCE) vulnerability via the pingAddr parameter of the tracert function.
CVSS Score: 7.2 (HIGH)
References: https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Tracert_1.md; https://github.com/SLoSnow9879/Phicomm_Router/blob/main/Tracert_1.md
CVE: CVE-2022-1807
Published: 2022-09-07
Description: Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-18-5-4; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-19-0-1; https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-18-5-4
CVE: CVE-2022-30312
Published: 2022-09-07
Description: The Trend Controls IC protocol through 2022-05-06 allows Cleartext Transmission of Sensitive Information. According to FSCT-2022-0050, there is a Trend Controls Inter-Controller (IC) protocol cleartext transmission of credentials issue. The affected components are characterized as: Inter-Controller (IC) protocol (57612/UDP). The potential impact is: Compromise of credentials. Several Trend Controls building automation controllers utilize the Inter-Controller (IC) protocol in for information exchange and automation purposes. This protocol offers authentication in the form of a 4-digit PIN in order to protect access to sensitive operations like strategy uploads and downloads as well as optional 0-30 character username and password protection for web page access protection. Both the PIN and usernames and passwords are transmitted in cleartext, allowing an attacker with passive interception capabilities to obtain these credentials. Credentials are transmitted in cleartext. An attacker who obtains Trend IC credentials can carry out sensitive engineering actions such as manipulating controller strategy or configuration settings. If the credentials in question are (re)used for other applications, their compromise could potentially facilitate lateral movement.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-08
CVE: CVE-2022-30078
Published: 2022-09-07
Description: NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://r6200v2.com; https://github.com/10TG/vulnerabilities/blob/main/Netgear/CVE-2022-30078/CVE-2022-30078.md; https://www.netgear.com/about/security/
CVE: CVE-2022-36069
Published: 2022-09-07
Description: Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands, Poetry correctly avoids Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems. Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by vetting any Git or Poetry config files that might be present in the directory. Versions 1.1.9 and 1.2.0b1 contain patches for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94, CWE-88
References: https://github.com/python-poetry/poetry/releases/tag/1.1.9; https://github.com/python-poetry/poetry/releases/tag/1.2.0b1; https://github.com/python-poetry/poetry/security/advisories/GHSA-9xgj-fcgf-x6mw
CVE: CVE-2022-36070
Published: 2022-09-07
Description: Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to the way Windows resolves executable names to paths. Unlike Linux-based operating systems, Windows searches for the executable in the current directory first and looks in the paths that are defined in the `PATH` environment variable afterward. This vulnerability can lead to Arbitrary Code Execution, which would lead to the takeover of the system. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems. Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe. The victim could also not protect themself by vetting any Git or Poetry config files that might be present in the directory, because the behavior is undocumented. Versions 1.1.9 and 1.2.0b1 contain patches for this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: https://github.com/python-poetry/poetry/releases/tag/1.1.9; https://github.com/python-poetry/poetry/releases/tag/1.2.0b1; https://github.com/python-poetry/poetry/security/advisories/GHSA-j4j9-7hg9-97g6
CVE: CVE-2022-38309
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/4; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/4
CVE: CVE-2022-38310
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/6; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/6
CVE: CVE-2022-38311
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/5; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/5
CVE: CVE-2022-38312
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/3; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/3
CVE: CVE-2022-38313
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/saveParentControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/2; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/2
CVE: CVE-2022-38314
Published: 2022-09-07
Description: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the urls parameter at /goform/saveParentControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/1; https://github.com/rickytriky/NWPU_Projct/tree/main/Tenda/AC18/1
CVE: CVE-2022-36073
Published: 2022-09-07
Description: RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.
CVSS Score: 8.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4d; https://github.com/rubygems/rubygems.org/security/advisories/GHSA-8qpf-wf2p-25vg; https://github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4d
CVE: CVE-2022-3129
Published: 2022-09-07
Description: A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207872.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/arbitrary_file_upload.md; https://vuldb.com/?id.207872; https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/arbitrary_file_upload.md
CVE: CVE-2022-3130
Published: 2022-09-07
Description: A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207873 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/sql_injection.md; https://vuldb.com/?id.207873; https://github.com/KingBridgeSS/Online_Driving_School_Project_In_PHP_With_Source_Code_Vulnerabilities/blob/main/sql_injection.md
CVE: CVE-2022-36049
Published: 2022-09-07
Description: Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-400, CWE-770
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44996; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48360; https://github.com/fluxcd/flux2/security/advisories/GHSA-p2g7-xwvr-rrw3
CVE: CVE-2022-36079
Published: 2022-09-07
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec; https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4; https://github.com/parse-community/parse-server/issues/8143
CVE: CVE-2022-36080
Published: 2022-09-07
Description: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Linbreux/wikmd/commit/259412c47d64d5b85980f95345179fbf05927798; https://github.com/Linbreux/wikmd/security/advisories/GHSA-9m4m-6gqx-gfj3; https://github.com/Linbreux/wikmd/commit/259412c47d64d5b85980f95345179fbf05927798
CVE: CVE-2022-36081
Published: 2022-09-07
Description: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-23, CWE-22
References: https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450; https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2; https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450
CVE: CVE-2020-19914
Published: 2022-09-07
Description: Cross Site Scripting (XSS) in xiunobbs 4.0.4 allows remote attackers to execute arbitrary web script or HTML via the attachment upload function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kevinoclam.github.io/blog/2019/07/31/xiunobbs-upload/; https://kevinoclam.github.io/blog/2019/07/31/xiunobbs-upload/
CVE: CVE-2022-36082
Published: 2022-09-07
Description: mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42; https://github.com/mansuf/mangadex-downloader/security/advisories/GHSA-r9x7-2xmr-v8fw; https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42
CVE: CVE-2022-36083
Published: 2022-09-07
Description: JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named `p2c` PBES2 Count, which determines how many PBKDF2 iterations must be executed in order to derive a CEK wrapping key. The purpose of this parameter is to intentionally slow down the key derivation function in order to make password brute-force and dictionary attacks more expensive. This makes the PBES2 algorithms unsuitable for situations where the JWE is coming from an untrusted source: an adversary can intentionally pick an extremely high PBES2 Count value, that will initiate a CPU-bound computation that may take an unreasonable amount of time to finish. Under certain conditions, it is possible to have the user's environment consume unreasonable amount of CPU time. The impact is limited only to users utilizing the JWE decryption APIs with symmetric secrets to decrypt JWEs from untrusted parties who do not limit the accepted JWE Key Management Algorithms (`alg` Header Parameter) using the `keyManagementAlgorithms` (or `algorithms` in v1.x) decryption option or through other means. The `v1.28.2`, `v2.0.6`, `v3.20.4`, and `v4.9.2` releases limit the maximum PBKDF2 iteration count to `10000` by default. It is possible to adjust this limit with a newly introduced `maxPBES2Count` decryption option. If users are unable to upgrade their required library version, they have two options depending on whether they expect to receive JWEs using any of the three PBKDF2-based JWE key management algorithms. They can use the `keyManagementAlgorithms` decryption option to disable accepting PBKDF2 altogether, or they can inspect the JOSE Header prior to using the decryption API and limit the PBKDF2 iteration count (`p2c` Header Parameter).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-834
References: https://github.com/panva/jose/commit/03d6d013bf6e070e85adfe5731f526978e3e8e4d; https://github.com/panva/jose/releases/tag/v4.9.2; https://github.com/panva/jose/security/advisories/GHSA-jv3g-j58f-9mq9
CVE: CVE-2022-38247
Published: 2022-09-07
Description: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-38248
Published: 2022-09-07
Description: Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-38249
Published: 2022-09-07
Description: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-38250
Published: 2022-09-07
Description: Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-38251
Published: 2022-09-07
Description: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-38254
Published: 2022-09-07
Description: Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7; https://www.nagios.com/downloads/nagios-xi/change-log/#5.8.7
CVE: CVE-2022-36086
Published: 2022-09-07
Description: linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-787, CWE-1284
References: https://github.com/rust-osdev/linked-list-allocator/commit/013b[PII_REDACTED]e8df5b17bbb495460ff47e8bbf; https://github.com/rust-osdev/linked-list-allocator/security/advisories/GHSA-xg8p-34w2-j49j; https://github.com/rust-osdev/linked-list-allocator/commit/013b[PII_REDACTED]e8df5b17bbb495460ff47e8bbf