deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3578
Published: 2020-10-21
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are configured. An attacker could exploit this vulnerability by accessing certain URLs on the affected device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-P73ABNWQ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-P73ABNWQ
CVE: CVE-2020-3580
Published: 2020-10-21
Description: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3580
CVE: CVE-2020-3581
Published: 2020-10-21
Description: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe
CVE: CVE-2020-3582
Published: 2020-10-21
Description: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe
CVE: CVE-2020-3583
Published: 2020-10-21
Description: Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe
CVE: CVE-2020-3585
Published: 2020-10-21
Description: A vulnerability in the TLS handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely on RSA for key exchange. An attacker could exploit this vulnerability by sending crafted TLS messages to the device, which would act as an oracle and allow the attacker to carry out a chosen-ciphertext attack. A successful exploit could allow the attacker to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions to the affected device. To exploit this vulnerability, an attacker must be able to perform both of the following actions: Capture TLS traffic that is in transit between clients and the affected device Actively establish a considerable number of TLS connections to the affected device
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tls-bb-2g9uWkP; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tls-bb-2g9uWkP
CVE: CVE-2020-3599
Published: 2020-10-21
Description: A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-rxss-L54Htxp; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-rxss-L54Htxp
CVE: CVE-2020-15244
Published: 2020-10-21
Description: In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74, CWE-502, CWE-502
References: https://github.com/OpenMage/magento-lts/commit/26433d15b57978fcb7701b5f99efe8332ca8630b; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jrgf-vfw2-hj26; https://github.com/OpenMage/magento-lts
CVE: CVE-2020-24422
Published: 2020-10-21
Description: Adobe Creative Cloud Desktop Application version 5.2 (and earlier) and 2.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/creative-cloud/apsb20-68.html; https://helpx.adobe.com/security/products/creative-cloud/apsb20-68.html
CVE: CVE-2020-27344
Published: 2020-10-21
Description: The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/qwebee/da79c6a9fa982c3c40988a1e0598c0d9; https://wordpress.org/plugins/cm-download-manager/#developers; https://gist.github.com/qwebee/da79c6a9fa982c3c40988a1e0598c0d9
CVE: CVE-2020-9747
Published: 2020-10-21
Description: Adobe Animate version 20.5 (and earlier) is affected by a double free vulnerability when parsing a crafted .fla file, which could result in arbitrary code execution in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://helpx.adobe.com/security/products/animate/apsb20-61.html; https://helpx.adobe.com/security/products/animate/apsb20-61.html
CVE: CVE-2020-9748
Published: 2020-10-21
Description: Adobe Animate version 20.5 (and earlier) is affected by a stack overflow vulnerability, which could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://helpx.adobe.com/security/products/animate/apsb20-61.html; https://helpx.adobe.com/security/products/animate/apsb20-61.html
CVE: CVE-2020-9749
Published: 2020-10-21
Description: Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb20-61.html; https://helpx.adobe.com/security/products/animate/apsb20-61.html
CVE: CVE-2020-9750
Published: 2020-10-21
Description: Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability, which could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .fla file in Animate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb20-61.html; https://helpx.adobe.com/security/products/animate/apsb20-61.html
CVE: CVE-2020-15265
Published: 2020-10-21
Description: In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. However, dim_size only does a DCHECK to validate the argument and then uses it to access the corresponding element of an array. Since in normal builds, `DCHECK`-like macros are no-ops, this results in segfault and access out of bounds of the array. The issue is patched in eccb7ec454e[PII_REDACTED]a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/commit/eccb7ec454e[PII_REDACTED]a255d77f08e60ee0808; https://github.com/tensorflow/tensorflow/issues/42105; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rrfp-j2mp-hq9c
CVE: CVE-2020-15266
Published: 2020-10-21
Description: In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault. The issue is patched in eccb7ec454e[PII_REDACTED]a255d77f08e60ee0808 and TensorFlow 2.4.0 will be released containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.
CVSS Score: 3.7 (LOW)
CWE: CWE-119, CWE-119
References: https://github.com/tensorflow/tensorflow/issues/42129; https://github.com/tensorflow/tensorflow/pull/42143/commits/3ade2efec2e90c6237de32a19680caaa3ebc2845; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xwhf-g6j5-j5gc
CVE: CVE-2020-24418
Published: 2020-10-21
Description: Adobe After Effects version 17.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted .aepx file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/after_effects/apsb20-62.html; https://helpx.adobe.com/security/products/after_effects/apsb20-62.html
CVE: CVE-2020-24419
Published: 2020-10-21
Description: Adobe After Effects version 17.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/after_effects/apsb20-62.html; https://helpx.adobe.com/security/products/after_effects/apsb20-62.html
CVE: CVE-2020-24420
Published: 2020-10-21
Description: Adobe Photoshop for Windows version 21.2.1 (and earlier) is affected by an uncontrolled search path element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/photoshop/apsb20-63.html; https://helpx.adobe.com/security/products/photoshop/apsb20-63.html
CVE: CVE-2020-24423
Published: 2020-10-21
Description: Adobe Media Encoder version 14.4 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-65.html; https://helpx.adobe.com/security/products/media-encoder/apsb20-65.html
CVE: CVE-2020-24424
Published: 2020-10-21
Description: Adobe Premiere Pro version 14.4 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/premiere_pro/apsb20-64.html; https://helpx.adobe.com/security/products/premiere_pro/apsb20-64.html
CVE: CVE-2020-24425
Published: 2020-10-21
Description: Dreamweaver version 20.2 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. Successful exploitation could result in a local user with permissions to write to the file system running system commands with administrator privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-427, CWE-427
References: https://helpx.adobe.com/security/products/dreamweaver/apsb20-55.html; https://helpx.adobe.com/security/products/dreamweaver/apsb20-55.html
CVE: CVE-2020-27615
Published: 2020-10-21
Description: The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2401010/loginizer; https://wpdeeply.com/loginizer-before-1-6-4-sqli-injection/; https://wpscan.com/vulnerability/10441
CVE: CVE-2020-17355
Published: 2020-10-21
Description: Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (restart of agents) by crafting a malformed DHCP packet which leads to an incorrect route being installed.
CVSS Score: 7.5 (HIGH)
References: https://www.arista.com/en/support/advisories-notices/security-advisories/11759-security-advisory-53; https://www.arista.com/en/support/advisories-notices/security-advisories/11759-security-advisory-53
CVE: CVE-2020-17454
Published: 2020-10-21
Description: WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0843; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0843
CVE: CVE-2020-24421
Published: 2020-10-21
Description: Adobe InDesign version 15.1.2 (and earlier) is affected by a NULL pointer dereference bug that occurs when handling a malformed .indd file. The impact is limited to causing a denial-of-service of the client application. User interaction is required to exploit this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://helpx.adobe.com/security/products/indesign/apsb20-66.html; https://helpx.adobe.com/security/products/indesign/apsb20-66.html
CVE: CVE-2020-27619
Published: 2020-10-22
Description: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVSS Score: 9.8 (CRITICAL)
References: https://bugs.python.org/issue41944; https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8; https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9
CVE: CVE-2020-27620
Published: 2020-10-22
Description: The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634749; https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634751; https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752
CVE: CVE-2020-27621
Published: 2020-10-22
Description: The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.
CVSS Score: 4.3 (MEDIUM)
References: https://gerrit.wikimedia.org/r/q/I24a240253c7a5c66dd493a68e8c23d95a17e1b21; https://phabricator.wikimedia.org/T265810; https://gerrit.wikimedia.org/r/q/I24a240253c7a5c66dd493a68e8c23d95a17e1b21
CVE: CVE-2020-27638
Published: 2020-10-22
Description: receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugs.debian.org/972521; https://fastd.readthedocs.io/en/stable/releases/v21.html; https://github.com/NeoRaider/fastd/commit/[PII_REDACTED]63b[PII_REDACTED]cdff9ccc46c33eaea
CVE: CVE-2020-27642
Published: 2020-10-22
Description: A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/bigbluebutton/greenlight/pull/2214; https://github.com/bigbluebutton/greenlight/pull/2214
CVE: CVE-2020-24033
Published: 2020-10-22
Description: An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/M0NsTeRRR/CVE-2020-24033; https://github.com/M0NsTeRRR/S3900-24T4S-CSRF-vulnerability; https://github.com/M0NsTeRRR/CVE-2020-24033
CVE: CVE-2020-27560
Published: 2020-10-22
Description: ImageMagick 7.0.10-34 allows Division by Zero in OptimizeLayerFrames in MagickCore/layer.c, which may cause a denial of service.
CVSS Score: 3.3 (LOW)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00037.html; https://github.com/ImageMagick/ImageMagick/commit/ef59bd764f88d893f1219fee8ba696a5d3f8c1c4; https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
CVE: CVE-2020-27646
Published: 2020-10-22
Description: Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
CVSS Score: 6.5 (MEDIUM)
References: https://cve.biscom.com/bis-sft-cv-0011/; https://cve.biscom.com/bis-sft-cv-0011/
CVE: CVE-2020-26649
Published: 2020-10-22
Description: AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php
CVSS Score: 8.1 (HIGH)
CWE: CWE-306, CWE-862
References: https://github.com/Drunyacoder/AtomXCMS-2/issues/19; https://github.com/Drunyacoder/AtomXCMS-2/issues/19
CVE: CVE-2020-26650
Published: 2020-10-22
Description: AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-668
References: https://github.com/Drunyacoder/AtomXCMS-2/issues/20; https://github.com/Drunyacoder/AtomXCMS-2/issues/20
CVE: CVE-2020-27533
Published: 2020-10-22
Description: A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/159772/DedeCMS-5.8-Cross-Site-Scripting.html; https://github.com/dedetech/issues/issues/16; http://packetstormsecurity.com/files/159772/DedeCMS-5.8-Cross-Site-Scripting.html
CVE: CVE-2020-27155
Published: 2020-10-22
Description: An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one.
CVSS Score: 7.5 (HIGH)
References: https://github.com/OctopusDeploy; https://github.com/OctopusDeploy/Issues/issues/6637; https://github.com/OctopusDeploy/Issues/issues/6639