deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25584
Published: 2024-09-06
Description: Dovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always be CR LF DOT CR LF. This causes Dovecot to convert single mail with LF DOT LF in middle, into two emails when relaying to SMTP. Dovecot will split mail with LF DOT LF into two mails. Upgrade to latest released version. No publicly available exploits are known.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-345
References: https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0001.json
CVE: CVE-2024-44401
Published: 2024-09-06
Description: D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8100GA1_Command_Injection.md/CVE-2024-44401; https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8100GA1_Command_Injection.md/D-link_DI_8100GA1_Command_Injection.md
CVE: CVE-2024-44402
Published: 2024-09-06
Description: D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/lonelylonglong/openfile-/blob/main/msp.md/CVE-2024-44402; https://github.com/lonelylonglong/openfile-/blob/main/msp.md/msp.md
CVE: CVE-2024-44408
Published: 2024-09-06
Description: D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded configuration files contain plaintext user passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-200
References: https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/CVE-2024-44408; https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/DIR-823G.md
CVE: CVE-2024-45294
Published: 2024-09-06
Description: The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperability Resources (FHIR) specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. This issue has been patched in release 6.3.23. No known workarounds are available.
CVSS Score: 8.6 (HIGH)
CWE: CWE-611
References: https://github.com/HL7/fhir-ig-publisher/releases/tag/1.6.22; https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-59rq-22fm-x8q5; https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.3.23
CVE: CVE-2024-45758
Published: 2024-09-06
Description: H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb; https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a[PII_REDACTED]cbb86422d1f6068
CVE: CVE-2024-8509
Published: 2024-09-06
Description: A vulnerability was found in Forklift Controller.  There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://access.redhat.com/errata/RHSA-2024:6487; https://access.redhat.com/security/cve/CVE-2024-8509; https://bugzilla.redhat.com/show_bug.cgi?id=2310406
CVE: CVE-2024-8517
Published: 2024-09-06
Description: SPIP before 4.3.2, 4.2.16, and 
4.1.18 is vulnerable to a command injection issue. A 
remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73, CWE-78
References: https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html; https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/; https://vozec.fr/researchs/spip-preauth-rce-2024-big-upload/
CVE: CVE-2022-27592
Published: 2024-09-06
Description: An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow local authenticated administrators to execute unauthorized code or commands via unspecified vectors.

We have already fixed the vulnerability in the following version:
Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Smart Client 2.4.0.0570 and later
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://www.qnap.com/en/security-advisory/qsa-24-22
CVE: CVE-2023-34974
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.
QuTScloud, QVR, QES are not affected.

We have already fixed the vulnerability in the following versions:
QTS 4.5.4.2790 build 20240605 and later
QuTS hero h4.5.4.2626 build 20231225 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-32
CVE: CVE-2023-34979
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 4.5.4.2790 build 20240605 and later
QuTS hero h4.5.4.2790 build 20240606 and later
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-32
CVE: CVE-2023-39298
Published: 2024-09-06
Description: A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated users to access data or perform actions that they should not be allowed to perform via unspecified vectors.
QuTScloud, is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.2.0.2737 build 20240417 and later
QuTS hero h5.2.0.2782 build 20240601 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://www.qnap.com/en/security-advisory/qsa-24-28
CVE: CVE-2023-39300
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2805 build 20240619 and later
QTS 4.3.4.2814 build 20240618 and later
QTS 4.3.3.2784 build 20240619 and later
QTS 4.2.6 build 20240618 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-26
CVE: CVE-2023-45038
Published: 2024-09-06
Description: An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network.

We have already fixed the vulnerability in the following version:
Music Station 5.4.0 and later
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-24-25
CVE: CVE-2023-47563
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
CVSS Score: 7.4 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-24
CVE: CVE-2023-50360
Published: 2024-09-06
Description: A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Video Station 5.8.1 ( 2024/02/26 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-24-24
CVE: CVE-2023-50366
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2023-51366
Published: 2024-09-06
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 8.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2023-51367
Published: 2024-09-06
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2023-51368
Published: 2024-09-06
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to launch a denial-of-service (DoS) attack via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2024-21897
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2024-21898
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2024-21903
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.6.2722 build 20240402 and later
QuTS hero h5.1.6.2734 build 20240414 and later
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-20
CVE: CVE-2024-21904
Published: 2024-09-06
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.7.2770 build 20240520 and later
QuTS hero h5.1.7.2770 build 20240520 and later
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-24-23
CVE: CVE-2024-21906
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-33
CVE: CVE-2024-27122
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
Notes Station 3 3.9.6 and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-21
CVE: CVE-2024-27125
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Helpdesk 3.3.1 and later
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-29
CVE: CVE-2024-27126
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
Notes Station 3 3.9.6 and later
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-21
CVE: CVE-2024-32762
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to inject malicious code via a network.

We have already fixed the vulnerability in the following versions:
QuLog Center 1.8.0.872 ( 2024/06/17 ) and later
QuLog Center 1.7.0.827 ( 2024/06/17 ) and later
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-30
CVE: CVE-2024-32763
Published: 2024-09-06
Description: A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-122
References: https://www.qnap.com/en/security-advisory/qsa-24-33
CVE: CVE-2024-32771
Published: 2024-09-06
Description: An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via unspecified vectors.
QuTScloud is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.2.0.2782 build 20240601 and later
QuTS hero h5.2.0.2782 build 20240601 and later
CVSS Score: 2.6 (LOW)
CWE: CWE-307
References: https://www.qnap.com/en/security-advisory/qsa-24-28
CVE: CVE-2024-38640
Published: 2024-09-06
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version:
Download Station 5.8.6.283 ( 2024/06/21 ) and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-24-35
CVE: CVE-2024-38641
Published: 2024-09-06
Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-24-33
CVE: CVE-2024-38642
Published: 2024-09-06
Description: An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compromise the security of the system via unspecified vectors.

We have already fixed the vulnerability in the following version:
QuMagie 2.3.1 and later
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-24-34
CVE: CVE-2024-45295
Published: 2024-09-06
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-45294. Reason: This candidate is a duplicate of CVE-2024-45294. Notes: All CVE users should reference CVE-2024-45294 instead of this candidate. This CVE was issued to a vulnerability that is dependent on CVE-2024-45294. According to rule 4.2.15 of the CVE CNA rules, "CNAs MUST NOT assign a different CVE ID to a Vulnerability that is fully interdependent with another Vulnerability. The Vulnerabilities are effectively the same single Vulnerability and MUST use one CVE ID."
CVE: CVE-2024-8394
Published: 2024-09-06
Description: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 128.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1895737; https://www.mozilla.org/security/advisories/mfsa2024-43/
CVE: CVE-2024-7652
Published: 2024-09-06
Description: An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-843
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1901411; https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r; https://www.mozilla.org/security/advisories/mfsa2024-29/
CVE: CVE-2024-34155
Published: 2024-09-06
Description: Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
CVSS Score: 4.3 (MEDIUM)
References: https://go.dev/cl/611238; https://go.dev/issue/69138; https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
CVE: CVE-2024-34156
Published: 2024-09-06
Description: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/611239; https://go.dev/issue/69139; https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
CVE: CVE-2024-34158
Published: 2024-09-06
Description: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://go.dev/cl/611240; https://go.dev/issue/69141; https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
CVE: CVE-2024-44844
Published: 2024-09-06
Description: DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/3okfc/IOT-VUL-WP/blob/main/DaryTek/vigor3900_1.md
CVE: CVE-2024-44845
Published: 2024-09-06
Description: DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-77
References: https://github.com/3okfc/IOT-VUL-WP/blob/main/DaryTek/vigor3900_2.md
CVE: CVE-2024-44838
Published: 2024-09-06
Description: RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/17
CVE: CVE-2024-44839
Published: 2024-09-06
Description: RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/18
CVE: CVE-2024-45771
Published: 2024-09-06
Description: RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OpenRapid/rapidcms/issues/17
CVE: CVE-2024-8439
Published: 2024-09-06
Description: Rejected reason: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that the issue does not pose a security risk as it falls within the expected functionality and security controls of the application.
CVE: CVE-2024-45034
Published: 2024-09-07
Description: Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. 
Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://github.com/apache/airflow/pull/41672; https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx; http://www.openwall.com/lists/oss-security/2024/09/06/3
CVE: CVE-2024-45498
Published: 2024-09-07
Description: Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see  https://github.com/apache/airflow/pull/41873  for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-116
References: https://github.com/apache/airflow/pull/41873; https://lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n; http://www.openwall.com/lists/oss-security/2024/09/06/2