deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36305
Published: 2024-06-10
Description: A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-572/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2024-36306
Published: 2024-06-10
Description: A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-service condition on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-568/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2024-36307
Published: 2024-06-10
Description: A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information about the agent on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-573/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2024-36358
Published: 2024-06-10
Description: A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1106
References: https://success.trendmicro.com/dcx/s/solution/000298151; https://www.zerodayinitiative.com/advisories/ZDI-24-575/; https://success.trendmicro.com/dcx/s/solution/000298151
CVE: CVE-2024-36359
Published: 2024-06-10
Description: A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://success.trendmicro.com/dcx/s/solution/000298065; https://www.zerodayinitiative.com/advisories/ZDI-24-574/; https://success.trendmicro.com/dcx/s/solution/000298065
CVE: CVE-2024-36419
Published: 2024-06-10
Description: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vc; https://github.com/salesagility/SuiteCRM-Core/security/advisories/GHSA-3323-hjq3-c6vc
CVE: CVE-2024-36471
Published: 2024-06-10
Description: Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them.

This issue affects Apache Allura from 1.0.1 through 1.16.0.

Users are recommended to upgrade to version 1.17.0, which fixes the issue.  If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.


CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-200, CWE-918
References: https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh; http://www.openwall.com/lists/oss-security/2024/06/10/1; https://lists.apache.org/thread/g43164t4bcp0tjwt4opxyks4svm8kvbh
CVE: CVE-2024-36473
Published: 2024-06-10
Description: Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Service (DoS) and under specific conditions can lead to elevation of privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-73
References: https://helpcenter.trendmicro.com/en-us/article/tmka-07247; https://www.zerodayinitiative.com/advisories/ZDI-24-585/; https://helpcenter.trendmicro.com/en-us/article/tmka-07247
CVE: CVE-2024-37166
Published: 2024-06-10
Description: ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protection against all types of XSS attacks in every scenario. This aligns with the approach taken by other template engines. Developers should be cautious and take additional measures to sanitize user input and prevent potential vulnerabilities. Additionally, the backtick character (`) is now also escaped to prevent the creation of strings in most cases where a malicious actor somehow gains the ability to write JavaScript. This does not provide comprehensive protection either.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-80
References: https://github.com/gurgunday/ghtml/commit/df1ea50fe8968a766fd2b9379a8f[PII_REDACTED]f8; https://github.com/gurgunday/ghtml/security/advisories/GHSA-vvhj-v88f-5gxr; https://github.com/gurgunday/ghtml/commit/df1ea50fe8968a766fd2b9379a8f[PII_REDACTED]f8
CVE: CVE-2024-37168
Published: 2024-06-10
Description: @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650; https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3; https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb
CVE: CVE-2024-37169
Published: 2024-06-10
Description: @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/jasonraimondi/url-to-png/commit/9336020c5e603323f5cf4a2ac3bb9a7735cf61f7; https://github.com/jasonraimondi/url-to-png/issues/47; https://github.com/jasonraimondi/url-to-png/releases/tag/v2.0.3
CVE: CVE-2024-37289
Published: 2024-06-10
Description: An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://success.trendmicro.com/dcx/s/solution/000298063; https://www.zerodayinitiative.com/advisories/ZDI-24-577/; https://success.trendmicro.com/dcx/s/solution/000298063
CVE: CVE-2022-37019
Published: 2024-06-10
Description: Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution.  HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7454-16/hpsbhf03943; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7454-16/hpsbhf03943
CVE: CVE-2022-37020
Published: 2024-06-10
Description: Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7454-16/hpsbhf03943; https://support.hp.com/us-en/document/ish_10[PII_REDACTED]7454-16/hpsbhf03943
CVE: CVE-2024-22244
Published: 2024-06-10
Description: Open Redirect in Harbor  <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://github.com/goharbor/harbor/security/advisories/GHSA-5757-v49g-f6r7; https://github.com/goharbor/harbor/security/advisories/GHSA-5757-v49g-f6r7
CVE: CVE-2024-22261
Published: 2024-06-11
Description: SQL-Injection in Harbor allows priviledge users to leak the task IDs
CVSS Score: 2.7 (LOW)
CWE: CWE-566, CWE-89
References: https://github.com/goharbor/harbor/security/advisories/GHSA-vw63-824v-qf2j; https://github.com/goharbor/harbor/security/advisories/GHSA-vw63-824v-qf2j
CVE: CVE-2024-37130
Published: 2024-06-11
Description: Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the machine. Exploitation may lead to a complete system compromise.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://www.dell.com/support/kbdoc/en-us/000225914/dsa-2024-264-dell-openmanage-server-administrator-omsa-security-update-for-local-privilege-escalation-via-xsl-hijacking-vulnerability; https://www.dell.com/support/kbdoc/en-us/000225914/dsa-2024-264-dell-openmanage-server-administrator-omsa-security-update-for-local-privilege-escalation-via-xsl-hijacking-vulnerability
CVE: CVE-2024-37177
Published: 2024-06-11
Description: SAP Financial Consolidation allows data to enter
a Web application through an untrusted source. These endpoints are exposed over
the network and it allows the user to modify the content from the web site. On
successful exploitation, an attacker can cause significant impact to
confidentiality and integrity of the application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://me.sap.com/notes/3457592; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3457592
CVE: CVE-2024-37178
Published: 2024-06-11
Description: SAP Financial Consolidation does not
sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting
(XSS) vulnerability. These endpoints are exposed over the network. The
vulnerability can exploit resources beyond the vulnerable component. On
successful exploitation, an attacker can cause limited impact to
confidentiality of the application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3457592; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3457592
CVE: CVE-2023-6745
Published: 2024-06-11
Description: The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/25d07a99-d425-4e1a-8adf-d[PII_REDACTED]?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE: CVE-2023-6748
Published: 2024-06-11
Description: The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-922
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7fcd0410-9423-4349-8d1c-3551de38a7c7?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE: CVE-2024-0627
Published: 2024-06-11
Description: The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/637f07c6-68cd-4ac6-83fd-65dbaab882fc?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE: CVE-2024-0653
Published: 2024-06-11
Description: The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9a88330e-fbeb-4ac7-a143-a59766accbeb?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069937%40custom-field-template&new=3069937%40custom-field-template&sfp_email=&sfph_mail=
CVE: CVE-2024-28164
Published: 2024-06-11
Description: SAP NetWeaver AS Java (CAF - Guided Procedures)
allows an unauthenticated user to access non-sensitive information about the
server which would otherwise be restricted causing low impact on
confidentiality of the application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://me.sap.com/notes/3425571; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3425571
CVE: CVE-2024-2473
Published: 2024-06-11
Description: The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/whattheslime/wps-show-login; https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve
CVE: CVE-2024-33001
Published: 2024-06-11
Description: SAP NetWeaver and ABAP platform allows an
attacker to impede performance for legitimate users by crashing or flooding the
service.



An
impact of this Denial of Service vulnerability might be long response delays
and service interruptions, thus degrading the service quality experienced by
legitimate users causing high impact on availability of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://me.sap.com/notes/3453170; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3453170
CVE: CVE-2024-34683
Published: 2024-06-11
Description: An authenticated attacker can upload malicious
file to SAP Document Builder service. When the victim accesses this file, the
attacker is allowed to access, modify, or make the related information
unavailable in the victim’s browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://me.sap.com/notes/3459379; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3459379
CVE: CVE-2024-34684
Published: 2024-06-11
Description: On Unix, SAP BusinessObjects Business
Intelligence Platform (Scheduling) allows an authenticated attacker with
administrator access on the local server to access the password of a local
account. As a result, an attacker can obtain non-administrative user
credentials, which will allow them to read or modify the remote server files.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: https://me.sap.com/notes/3441817; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3441817
CVE: CVE-2024-34686
Published: 2024-06-11
Description: Due to insufficient input validation, SAP CRM
WebClient UI allows an unauthenticated attacker to craft a URL link which
embeds a malicious script. When a victim clicks on this link, the script will
be executed in the victim's browser giving the attacker the ability to access
and/or modify information with no effect on availability of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3465129; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3465129
CVE: CVE-2024-34688
Published: 2024-06-11
Description: Due to unrestricted access to the Meta Model
Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks
on the application, which may prevent legitimate users from accessing it. This
can result in no impact on confidentiality and integrity but a high impact on
the availability of the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://me.sap.com/notes/3460407; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3460407
CVE: CVE-2024-34690
Published: 2024-06-11
Description: SAP Student Life Cycle
Management (SLcM) fails to conduct proper authorization checks for
authenticated users, leading to the potential escalation of privileges. On
successful exploitation it could allow an attacker to access and edit
non-sensitive report variants that are typically restricted, causing minimal
impact on the confidentiality and integrity of the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3457265; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3457265
CVE: CVE-2024-34691
Published: 2024-06-11
Description: Manage Incoming Payment Files (F1680) of SAP
S/4HANA does not perform necessary authorization checks for an authenticated
user, resulting in escalation of privileges. As a result, it has high impact on
integrity and no impact on the confidentiality and availability of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3466175; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3466175
CVE: CVE-2024-37176
Published: 2024-06-11
Description: SAP BW/4HANA Transformation and Data Transfer
Process (DTP) allows an authenticated attacker to gain higher access levels
than they should have by exploiting improper authorization checks. This results
in escalation of privileges. It has no impact on the confidentiality of data
but may have low impacts on the integrity and availability of the application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3465455; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3465455
CVE: CVE-2024-5090
Published: 2024-06-11
Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SiteOrigin Blog Widget in all versions up to, and including, 1.61.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3098819/so-widgets-bundle; https://www.wordfence.com/threat-intel/vulnerabilities/id/2878de45-0123-4e07-bfec-015b36b11d01?source=cve; https://plugins.trac.wordpress.org/changeset/3098819/so-widgets-bundle
CVE: CVE-2023-7264
Published: 2024-06-11
Description: The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640, CWE-640
References: https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3688; https://plugins.trac.wordpress.org/browser/build-app-online/tags/1.0.21/public/class-build-app-online-public.php#L3757; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201569%40build-app-online&new=3201569%40build-app-online&sfp_email=&sfph_mail=
CVE: CVE-2024-29855
Published: 2024-06-11
Description: Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-798
References: https://www.veeam.com/kb4585; https://www.veeam.com/kb4585
CVE: CVE-2024-31400
Published: 2024-06-11
Description: Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. If this vulnerability is exploited, unintended data may be left in forwarded mail.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922
References: https://cs.cybozu.co.jp/2024/007901.html; https://jvn.jp/en/jp/JVN28869536/; https://cs.cybozu.co.jp/2024/007901.html