deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-39669
Published: 2024-06-27
Description: In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly execute arbitrary code in the Sync Server and compromise security.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://bookstack.soffid.com/books/security-advisories/page/cve-2024-39669; https://bookstack.soffid.com/books/security-advisories/page/cve-2024-39669
CVE: CVE-2024-6388
Published: 2024-06-27
Description: Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-497, CWE-319
References: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2068944; https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24; https://www.cve.org/CVERecord?id=CVE-2024-6388
CVE: CVE-2023-38371
Published: 2024-06-27
Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  261198.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261198; https://www.ibm.com/support/pages/node/7158790; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-42011
Published: 2024-06-27
Description: IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.  IBM X-Force ID:  265508.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265508; https://www.ibm.com/support/pages/node/7158657; https://exchange.xforce.ibmcloud.com/vulnerabilities/265508
CVE: CVE-2023-42014
Published: 2024-06-27
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  265511.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/265511; https://www.ibm.com/support/pages/node/7158654; https://exchange.xforce.ibmcloud.com/vulnerabilities/265511
CVE: CVE-2024-24792
Published: 2024-06-27
Description: Parsing a corrupt or malicious image with invalid color indices can cause a panic.
CVSS Score: 7.5 (HIGH)
References: https://go.dev/cl/588115; https://go.dev/issue/67624; https://pkg.go.dev/vuln/GO-2024-2937
CVE: CVE-2024-31916
Published: 2024-06-27
Description: IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels.  IBM X-ForceID:  290026.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/290026; https://www.ibm.com/support/pages/node/7158679; https://exchange.xforce.ibmcloud.com/vulnerabilities/290026
CVE: CVE-2024-35153
Published: 2024-06-27
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  292640.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292640; https://www.ibm.com/support/pages/node/7158662; https://exchange.xforce.ibmcloud.com/vulnerabilities/292640
CVE: CVE-2024-35260
Published: 2024-06-27
Description: An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
CVSS Score: 8.0 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35260; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35260
CVE: CVE-2024-5334
Published: 2024-06-27
Description: A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-73
References: https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2; https://huntr.com/bounties/7eec128b-1bf5-4922-a95c-551ad3695cf6; https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
CVE: CVE-2024-5547
Published: 2024-06-27
Description: A directory traversal vulnerability exists in the /api/download-project-pdf endpoint of the stitionai/devika repository, affecting the latest version. The vulnerability arises due to insufficient sanitization of the 'project_name' parameter in the download_project_pdf function. Attackers can exploit this flaw by manipulating the 'project_name' parameter in a GET request to traverse the directory structure and download arbitrary PDF files from the system. This issue allows attackers to access sensitive information that could be stored in PDF format outside the intended directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2; https://huntr.com/bounties/7ea0eb5f-7643-4452-bc93-a225e2090283; https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
CVE: CVE-2024-5548
Published: 2024-06-27
Description: A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'project_name' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'download_project' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2; https://huntr.com/bounties/ad7dd135-8839-4042-87c0-105af61d262c; https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
CVE: CVE-2023-30997
Published: 2024-06-27
Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls.  IBM X-Force ID:  254638.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254638; https://www.ibm.com/support/pages/node/7158790; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-30998
Published: 2024-06-27
Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls.  IBM X-Force ID:  254649.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/254649; https://www.ibm.com/support/pages/node/7158790; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-38368
Published: 2024-06-27
Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls.  IBM X-Force ID:  261195.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261195; https://www.ibm.com/support/pages/node/7158790; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2023-38370
Published: 2024-06-27
Description: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages.  IBM X-Force ID:  261197.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/261197; https://www.ibm.com/support/pages/node/7158790; http://seclists.org/fulldisclosure/2024/Nov/0
CVE: CVE-2024-2882
Published: 2024-06-27
Description: SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. This breach could potentially lead to unauthorized control, data manipulation, and access to sensitive information within the SCADA system.
CWE: CWE-862
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-02
CVE: CVE-2024-3017
Published: 2024-06-27
Description: In a 

Silicon Labs  multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (RCP) causes the OpenThread Border Router(OTBR) application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://community.silabs.com/069Vm000007UEhZIAW; https://github.com/SiliconLabs/simplicity_sdk; https://community.silabs.com/069Vm000007UEhZIAW
CVE: CVE-2024-3043
Published: 2024-06-27
Description: An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a denial of service. This packet type is not useful in production and should be used only for PHY qualification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-829
References: https://community.silabs.com/069Vm000005UCH0IAO; https://github.com/SiliconLabs/gecko_sdk; https://community.silabs.com/069Vm000005UCH0IAO
CVE: CVE-2024-3330
Published: 2024-06-27
Description: Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-250
References: https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/; https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/
CVE: CVE-2024-3331
Published: 2024-06-27
Description: Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spotfire Spotfire Analyst, Spotfire Spotfire Desktop, Spotfire Spotfire Server allows The impact of this vulnerability depends on the privileges of the user running the affected software..This issue affects Spotfire Enterprise Runtime for R - Server Edition: from 1.12.7 through 1.20.0; Spotfire Statistics Services: from 12.0.7 through 12.3.1, from 14.0.0 through 14.3.0; Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0.0 through 14.3.0; Spotfire Desktop: from 14.0 through 14.3.0; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0.0 through 14.3.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3331-r3436/; https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3331-r3436/
CVE: CVE-2024-4578
Published: 2024-06-27
Description: This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “config” user is able to cause a privilege escalation via spawning a bash shell. The SSH CLI session does not require high permissions to exploit this vulnerability, but the config password is required to establish the session. The spawned shell is able to obtain root privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://www.arista.com/en/support/advisories-notices/security-advisory/19844-security-advisory-0098; https://www.arista.com/en/support/advisories-notices/security-advisory/19844-security-advisory-0098
CVE: CVE-2024-5710
Published: 2024-06-27
Description: berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970; https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970
CVE: CVE-2024-5714
Published: 2024-06-27
Description: In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. This vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (`org_id` should be `orgId`) that prevents proper user organization validation. As a result, attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/43206bacac3b43ad9f2db6dafd165e61a21e6b97; https://huntr.com/bounties/8cff4afa-131b-4a7e-9f0d-8a3c69f3d024; https://huntr.com/bounties/8cff4afa-131b-4a7e-9f0d-8a3c69f3d024
CVE: CVE-2024-5751
Published: 2024-06-27
Description: BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment` function, which decodes and decrypts environment variables from base64 and assigns them to `os.environ`. An attacker can exploit this by sending a malicious payload to the `/config/update` endpoint, which is then processed and executed by the server when the `get_secret` function is triggered. This requires the server to use Google KMS and a database to store a model.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce; https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce
CVE: CVE-2024-5755
Published: 2024-06-27
Description: In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-821
References: https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f; https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f
CVE: CVE-2024-5820
Published: 2024-06-27
Description: An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any such malicious website to intercept all communication between the user and the backend. This vulnerability can lead to unauthorized command execution and potential server-side request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://huntr.com/bounties/2ba757bf-8ede-445b-b143-2de7769758a6; https://huntr.com/bounties/2ba757bf-8ede-445b-b143-2de7769758a6
CVE: CVE-2024-5822
Published: 2024-06-27
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potentially bypassing security controls and accessing sensitive data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://huntr.com/bounties/b24f1b5f-a529-435b-ac4d-5ca71d5d1fb5; https://huntr.com/bounties/b24f1b5f-a529-435b-ac4d-5ca71d5d1fb5
CVE: CVE-2024-5824
Published: 2024-06-27
Description: A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the `configs/config.yaml` file. This can lead to remote code execution by changing server configuration properties such as `force_accept_remote_access` and `turn_on_code_validation`.
CVSS Score: 7.4 (HIGH)
CWE: CWE-22
References: https://github.com/parisneo/lollms/commit/eda3af5f5c4ea9b2f3569f72f8d05989e29367fc; https://huntr.com/bounties/9ceb7cf9-a7cd-4699-b3f8-d0999d2b49fd; https://github.com/parisneo/lollms/commit/eda3af5f5c4ea9b2f3569f72f8d05989e29367fc
CVE: CVE-2024-5826
Published: 2024-06-27
Description: In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of a sandbox when executing LLM-generated code, allowing an attacker to manipulate the code executed by the `exec` function in `src/vanna/base/base.py`. This vulnerability can be exploited by an attacker to achieve remote code execution on the app backend server, potentially gaining full control of the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://huntr.com/bounties/90620087-44ac-4e43-b659-3c5d30889369; https://huntr.com/bounties/90620087-44ac-4e43-b659-3c5d30889369
CVE: CVE-2024-5885
Published: 2024-06-27
Description: stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not provide sufficient controls when crawling a website, allowing an attacker to access applications on the local network. This vulnerability could allow a malicious user to gain access to internal servers, the AWS metadata endpoint, and capture Supabase data.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://huntr.com/bounties/c178bf48-1d4a-4743-87ca-4cc8e475d274; https://huntr.com/bounties/c178bf48-1d4a-4743-87ca-4cc8e475d274
CVE: CVE-2024-5933
Published: 2024-06-27
Description: A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attacker to inject malicious scripts via chat messages, which are then executed in the context of the user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517; https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517
CVE: CVE-2024-5935
Published: 2024-06-27
Description: A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://huntr.com/bounties/b374f1c9-fa25-4b52-a34d-5153afd5a295; https://huntr.com/bounties/b374f1c9-fa25-4b52-a34d-5153afd5a295
CVE: CVE-2024-5936
Published: 2024-06-27
Description: An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d; https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d
CVE: CVE-2024-5979
Published: 2024-06-27
Description: In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5; https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458; https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458
CVE: CVE-2024-5980
Published: 2024-06-27
Description: A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a; https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3; https://huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3
CVE: CVE-2024-6038
Published: 2024-06-27
Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-1333
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/fcdd5fd6b05ef537a1db185ab115758d87e1ba3f; https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d; https://huntr.com/bounties/d41cca0a-82bc-4cbf-a52a-928d304fb42d