deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-2002
Published: 2023-05-26
Description: A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-250, CWE-863
References: https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-2817
Published: 2023-05-26
Description: A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb; https://www.tenable.com/security/research/tra-2023-20%2C; https://github.com/craftcms/cms/commit/7655e1009ba6cdbfb230e6bb138b775b69fc7bcb
CVE: CVE-2023-31225
Published: 2023-05-26
Description: The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-31226
Published: 2023-05-26
Description: The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-31227
Published: 2023-05-26
Description: The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://consumer.huawei.com/en/support/bulletin/2023/5/; https://consumer.huawei.com/en/support/bulletin/2023/5/
CVE: CVE-2023-33779
Published: 2023-05-26
Description: A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://xxl-job.com; https://github.com/silence-silence/xxl-job-lateral-privilege-escalation-vulnerability-/blob/main/README.md; https://github.com/xuxueli/xxl-job
CVE: CVE-2023-33780
Published: 2023-05-26
Description: A stored cross-site scripting (XSS) vulnerability in TFDi Design smartCARS 3 v0.7.0 and below allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the body of news article.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-hx8p-f8h7-5h78; https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-hx8p-f8h7-5h78
CVE: CVE-2023-1664
Published: 2023-05-26
Description: A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0; https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0
CVE: CVE-2023-1667
Published: 2023-05-26
Description: A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.libssh.org/security/advisories/CVE-2023-1667.txt; https://access.redhat.com/security/cve/CVE-2023-1667; https://bugzilla.redhat.com/show_bug.cgi?id=2182199
CVE: CVE-2023-1981
Published: 2023-05-26
Description: A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://access.redhat.com/security/cve/CVE-2023-1981; https://bugzilla.redhat.com/show_bug.cgi?id=2185911; https://github.com/lathiat/avahi/issues/375
CVE: CVE-2023-20868
Published: 2023-05-26
Description: NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.vmware.com/security/advisories/VMSA-2023-0010.html; https://www.vmware.com/security/advisories/VMSA-2023-0010.html
CVE: CVE-2023-22970
Published: 2023-05-26
Description: Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
CVSS Score: 7.8 (HIGH)
References: https://github.com/bottlesdevs/Bottles/issues/2463; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N24KI3O3FWGKJSLATY35ZM3CHSABJ6WE/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJZEE4RAAK7OPVQNE4BOWUVQDVSZU6NJ/
CVE: CVE-2023-2283
Published: 2023-05-26
Description: A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html; https://access.redhat.com/security/cve/CVE-2023-2283; https://bugzilla.redhat.com/show_bug.cgi?id=2189736
CVE: CVE-2023-32318
Published: 2023-05-26
Description: Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account the previous session would be continued and the attacker would be authenticated as the previously logged in user. It is recommended that the Nextcloud Server is upgraded to 25.0.6 or 26.0.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38; https://github.com/nextcloud/text/pull/3946; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q8c4-chpj-6v38
CVE: CVE-2023-32681
Published: 2023-05-26
Description: Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5; https://github.com/psf/requests/releases/tag/v2.31.0; https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q
CVE: CVE-2023-33197
Published: 2023-05-26
Description: Craft is a CMS for creating custom digital experiences on the web. Cross-site scripting (XSS) can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

CVSS Score: 5.5 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://github.com/craftcms/cms/commit/8c2ad0bd313015b8ee42326af2848ee748f1d766; https://github.com/craftcms/cms/releases/tag/4.4.6; https://github.com/craftcms/cms/security/advisories/GHSA-6qjx-787v-6pxr
CVE: CVE-2023-33247
Published: 2023-05-26
Description: Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the server. (A mitigation is that the remote harvesting server should be behind a firewall that only allows access to the Talend Data Catalog server.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs; https://help.talend.com/r/en-US/Talend-Products-CVEs/Talend-Products-CVEs
CVE: CVE-2023-33255
Published: 2023-05-26
Description: An issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web application without any kind of sanitization. This allows injection of arbitrary JavaScript code into image metadata, which is executed when that metadata is displayed in the Papaya web application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/172644/Papaya-Medical-Viewer-1.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2023/May/21; https://schutzwerk.com
CVE: CVE-2023-28319
Published: 2023-05-26
Description: A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: http://seclists.org/fulldisclosure/2023/Jul/47; http://seclists.org/fulldisclosure/2023/Jul/48; http://seclists.org/fulldisclosure/2023/Jul/52
CVE: CVE-2023-28320
Published: 2023-05-26
Description: A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-400, CWE-362, CWE-400
References: http://seclists.org/fulldisclosure/2023/Jul/47; http://seclists.org/fulldisclosure/2023/Jul/48; http://seclists.org/fulldisclosure/2023/Jul/52
CVE: CVE-2023-28321
Published: 2023-05-26
Description: An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://seclists.org/fulldisclosure/2023/Jul/47; http://seclists.org/fulldisclosure/2023/Jul/48; http://seclists.org/fulldisclosure/2023/Jul/52
CVE: CVE-2023-28322
Published: 2023-05-26
Description: An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2023/Jul/47; http://seclists.org/fulldisclosure/2023/Jul/48; http://seclists.org/fulldisclosure/2023/Jul/52
CVE: CVE-2023-2825
Published: 2023-05-26
Description: An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2825.json; https://gitlab.com/gitlab-org/gitlab/-/issues/412371; https://hackerone.com/reports/1994725
CVE: CVE-2023-2854
Published: 2023-05-26
Description: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2854.json; https://gitlab.com/wireshark/wireshark/-/issues/19084; https://security.gentoo.org/glsa/202309-02
CVE: CVE-2023-2855
Published: 2023-05-26
Description: Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2855.json; https://gitlab.com/wireshark/wireshark/-/issues/19062; https://security.gentoo.org/glsa/202309-02
CVE: CVE-2023-2856
Published: 2023-05-26
Description: VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2856.json; https://gitlab.com/wireshark/wireshark/-/issues/19083; https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html
CVE: CVE-2023-2857
Published: 2023-05-26
Description: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2857.json; https://gitlab.com/wireshark/wireshark/-/issues/19063; https://security.gentoo.org/glsa/202309-02
CVE: CVE-2023-2858
Published: 2023-05-26
Description: NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2858.json; https://gitlab.com/wireshark/wireshark/-/issues/19081; https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html
CVE: CVE-2023-2879
Published: 2023-05-26
Description: GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2879.json; https://gitlab.com/wireshark/wireshark/-/issues/19068; https://lists.debian.org/debian-lts-announce/2023/06/msg00004.html
CVE: CVE-2023-33185
Published: 2023-05-26
Description: Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://github.com/django-ses/django-ses/blob/3d[PII_REDACTED]76487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md; https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795; https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25
CVE: CVE-2023-33187
Published: 2023-05-26
Description: Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used. This issue was patched in version 6.0.0.
This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated. 

CVSS Score: 5.4 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc; https://github.com/rrweb-io/rrweb/pull/1184; https://github.com/highlight/highlight/security/advisories/GHSA-9qpj-qq2r-5mcc
CVE: CVE-2023-33194
Published: 2023-05-26
Description: Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in version 4.4.6.
CVSS Score: 3.7 (LOW)
CWE: CWE-80, CWE-79
References: https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888; https://github.com/craftcms/cms/releases/tag/4.4.6; https://github.com/craftcms/cms/security/advisories/GHSA-3wxg-w96j-8hq9
CVE: CVE-2023-33196
Published: 2023-05-26
Description: Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.


CVSS Score: 5.5 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7; https://github.com/craftcms/cms/releases/tag/4.4.7; https://github.com/craftcms/cms/security/advisories/GHSA-cjmm-x9x9-m2w5
CVE: CVE-2023-21514
Published: 2023-05-26
Description: Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21515
Published: 2023-05-26
Description: InstantPlay which included vulnerable script which could execute javascript in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-21516
Published: 2023-05-26
Description: XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-79
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01; https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=01
CVE: CVE-2023-27311
Published: 2023-05-26
Description: NetApp Blue XP Connector versions prior to 3.9.25 expose information via a directory listing. A new Connector architecture resolves this issue - obtaining the fix requires redeploying a fresh Connector.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-2898
Published: 2023-05-26
Description: There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476, CWE-362, CWE-476
References: https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html; https://lore.kernel.org/linux-f2fs-devel/[PII_REDACTED]4[PII_REDACTED]-1-chao%40kernel.org/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-31128
Published: 2023-05-26
Description: NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. This issue is fixed in commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch. There is no risk for the user of the app within the NextCloud server. This only affects the main repository and possible forks of it. Those who have forked the NextCloud Cookbook repository should make sure their forks are on the latest version to prevent code injection attacks and similar.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/nextcloud/cookbook/blob/a14d6ffc4d45e1447556f68606129dfd6c1505cf/.github/workflows/pull-checks.yml#L67; https://github.com/nextcloud/cookbook/commit/489bb744; https://github.com/nextcloud/cookbook/commit/a46d98559e2c64292da9ffb06138cccc2e50ae1b