deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-27105
Published: 2022-07-26
Description: InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a local user or network administrator to execute HTML / Javascript in the Outlook of users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.inmailx.com/products/inmailx; https://gist.github.com/0xVavaldi/9b7afbfe[PII_REDACTED]0f7613805d3b7f; http://www.inmailx.com/products/inmailx
CVE: CVE-2022-29951
Published: 2022-07-26
Description: JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) for a wide variety of engineering purposes such as starting and stopping the PLC, downloading and uploading projects, and changing configuration settings. This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02
CVE: CVE-2022-29952
Published: 2022-07-26
Description: Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols (60005/TCP, 60007/TCP) for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration (BNMC) software. These protocols provide configuration management and historical data related functionality. Neither protocol has any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
CVE: CVE-2022-29953
Published: 2022-07-26
Description: The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded credentials. An attacker capable of connecting to this interface can thus trivially take over its functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-02
CVE: CVE-2022-29957
Published: 2022-07-26
Description: The Emerson DeltaV Distributed Control System (DCS) through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade (18508/TCP, 18518/TCP); Plug-and-Play (18510/UDP); Hawk services (18507/UDP); Management (18519/TCP); Cold restart (18512/UDP); SIS communications (12345/TCP); and Wireless Gateway Protocol (18515/UDP). None of these protocols have any authentication features, allowing any attacker capable of communicating with the ports in question to invoke (a subset of) desired functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
CVE: CVE-2022-29958
Published: 2022-07-26
Description: JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02
CVE: CVE-2022-29960
Published: 2022-07-26
Description: Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hardcoded cryptographic keys is used for protection of certain system credentials, engineering files, and sensitive utilities.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-221-03; https://www.forescout.com/blog/
CVE: CVE-2022-29962
Published: 2022-07-26
Description: The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
CVE: CVE-2022-29963
Published: 2022-07-26
Description: The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from CVE-2014-2350.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
CVE: CVE-2022-29964
Published: 2022-07-26
Description: The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
CVE: CVE-2022-29965
Published: 2022-07-26
Description: The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These passwords are generated using a deterministic, insecure algorithm using a single seed value composed of a day/hour/minute timestamp with less than 16 bits of entropy. The seed value is fed through a lookup table and a series of permutation operations resulting in three different four-character passwords corresponding to different privilege levels. An attacker can easily reconstruct these passwords and thus gain access to privileged maintenance operations. NOTE: this is different from CVE-2014-2350.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-03
CVE: CVE-2022-30273
Published: 2022-07-26
Description: The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327, CWE-345
References: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05; https://www.forescout.com/blog/
CVE: CVE-2022-30275
Published: 2022-07-26
Description: The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05
CVE: CVE-2022-31204
Published: 2022-07-26
Description: Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02
CVE: CVE-2022-31205
Published: 2022-07-26
Description: In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02
CVE: CVE-2022-31206
Published: 2022-07-26
Description: The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02
CVE: CVE-2022-31207
Published: 2022-07-26
Description: The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02
CVE: CVE-2021-33057
Published: 2022-07-26
Description: The QQ application 8.7.1 for Android and iOS does not enforce the permission requirements (e.g., android.permission.ACCESS_FINE_LOCATION) for determining the device's physical location. An attacker can use qq.createMapContext to create a MapContext object, use MapContext.moveToLocation to move the center of the map to the device's location, and use MapContext.getCenterLocation to get the latitude and longitude of the current map center.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://arxiv.org/pdf/2205.15202.pdf; https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/QQ%20applet%20location%20permission%20vulnerability%20report.pdf; https://tencent.com
CVE: CVE-2021-40180
Published: 2022-07-26
Description: In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://arxiv.org/pdf/2205.15202.pdf; https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdf; https://pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvA
CVE: CVE-2022-30269
Published: 2022-07-26
Description: Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE: CVE-2022-30270
Published: 2022-07-26
Description: The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5 preconfigured accounts (root, abuilder, acelogin, cappl, ace), all of which come with default credentials. Although the ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default credentials, the cappl and ace accounts remain undocumented and thus are unlikely to have their credentials changed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE: CVE-2022-30271
Published: 2022-07-26
Description: The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-259
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE: CVE-2022-30272
Published: 2022-07-26
Description: The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-345
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE: CVE-2022-30274
Published: 2022-07-26
Description: The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE: CVE-2022-30276
Published: 2022-07-26
Description: The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication (MDLC) networks (potentially over a variety of serial, RF and/or Ethernet links) and TCP/IP networks. Communication with RTUs behind the gateway is done by means of the proprietary IPGW protocol (5001/TCP). This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-04; https://www.forescout.com/blog/; https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-04
CVE: CVE-2022-36129
Published: 2022-07-26
Description: HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. Fixed in Vault Enterprise 1.9.8, 1.10.5, and 1.11.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://discuss.hashicorp.com; https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-34594
Published: 2022-07-27
Description: Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Subject text field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/gitgeniuss/bug_report/blob/master/vendors/itsourcecode.com/advanced-school-management-system/XSS-1.md; https://github.com/gitgeniuss/bug_report/blob/master/vendors/itsourcecode.com/advanced-school-management-system/XSS-1.md
CVE: CVE-2022-34611
Published: 2022-07-27
Description: A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac #" text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://online.com; https://github.com/As4ki/CVE-report/blob/main/OFRS.md; https://www.sourcecodester.com/
CVE: CVE-2022-34612
Published: 2022-07-27
Description: Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/rizinorg/rizin/issues/2738; https://github.com/rizinorg/rizin/pull/2739; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQZLMHEI5D7EJASA5UW6XN4ODHLRHK6N/
CVE: CVE-2022-34971
Published: 2022-07-27
Description: An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/liufee/cms/issues/62; https://github.com/liufee/cms/issues/62
CVE: CVE-2022-36879
Published: 2022-07-27
Description: An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=f85daf0e725358be78dfd208dea5fd665d8cb901; https://github.com/torvalds/linux/commit/f85daf0e725358be78dfd208dea5fd665d8cb901; https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html
CVE: CVE-2022-36880
Published: 2022-07-27
Description: The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.webmin.com/security.html; https://www.webmin.com/security.html
CVE: CVE-2022-27610
Published: 2022-07-27
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.synology.com/security/advisory/Synology_SA_20_06; https://www.synology.com/security/advisory/Synology_SA_20_06
CVE: CVE-2022-2310
Published: 2022-07-27
Description: An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US; https://kcm.trellix.com/corporate/index?page=content&id=SB10384&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US