deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6317
Published: 2020-11-30
Description: In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears in the installation log files. This information although sensitive is of limited utility and cannot be used to further access, modify or render unavailable any other information in the cockpit or system. This affects SAP Adaptive Server Enterprise, Versions - 15.7, 16.0.
CVSS Score: 3.5 (LOW)
CWE: CWE-532
References: https://launchpad.support.sap.com/#/notes/2953203; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=557449700; https://launchpad.support.sap.com/#/notes/2953203
CVE: CVE-2020-8351
Published: 2020-11-30
Description: A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-16, CWE-269
References: https://iknow.lenovo.com.cn/detail/dc_193055.html; https://iknow.lenovo.com.cn/detail/dc_193055.html
CVE: CVE-2020-27585
Published: 2020-11-30
Description: Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on the settings password.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-521
References: https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/; https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/
CVE: CVE-2020-27586
Published: 2020-11-30
Description: Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/; https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/
CVE: CVE-2020-27587
Published: 2020-11-30
Description: Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the password.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-521
References: https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/; https://cyberworldmirror.com/quick-heal-addressed-multiple-vulnerabilities-in-version-19-update-now/
CVE: CVE-2020-29395
Published: 2020-11-30
Description: The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160282/WordPress-EventON-Calendar-3.0.5-Cross-Site-Scripting.html; https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS; https://www.myeventon.com/news/
CVE: CVE-2020-11867
Published: 2020-11-30
Description: Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: https://github.com/audacity/audacity/releases; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MG5PSF4CJ7UPMJHWX553EG3P2XN3PAYI/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WKK3S2QBXBHOFOQMXMGY5QAKVUWUX2YY/
CVE: CVE-2020-16849
Published: 2020-11-30
Description: An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handling a packet sent by an unauthenticated network attacker, may expose Sensitive Information.
CVSS Score: 7.5 (HIGH)
References: https://blog.scadafence.com/vulnerability-report-cve-2020-16849; https://www.canon-europe.com/support/product-security/; https://blog.scadafence.com/vulnerability-report-cve-2020-16849
CVE: CVE-2020-16850
Published: 2020-11-30
Description: Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-400
References: https://blog.scadafence.com/vulnerability-in-mitsubishi-electric-melsec-iq-r-series; https://us-cert.cisa.gov/ics/advisories/icsa-20-282-02; https://blog.scadafence.com/vulnerability-in-mitsubishi-electric-melsec-iq-r-series
CVE: CVE-2020-29438
Published: 2020-11-30
Description: Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. This allows attackers to construct firmware that retrieves an unlock code from a secure enclave chip.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347
References: https://www.wired.com/story/tesla-model-x-hack-bluetooth/; https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE: CVE-2020-29439
Published: 2020-11-30
Description: Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module (BCM) to initiate a Bluetooth wake-up action. (The full VIN is visible from outside the vehicle.)
CVSS Score: 4.6 (MEDIUM)
References: https://www.wired.com/story/tesla-model-x-hack-bluetooth/; https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE: CVE-2020-29440
Published: 2020-11-30
Description: Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control module (BCM). This allows an attacker (who is inside a vehicle, or is otherwise able to send data over the CAN bus) to start and drive the vehicle with a spoofed key fob.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-295
References: https://www.wired.com/story/tesla-model-x-hack-bluetooth/; https://www.wired.com/story/tesla-model-x-hack-bluetooth/
CVE: CVE-2020-29441
Published: 2020-11-30
Description: An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space (Denial of Service), corrupt legitimate data if files are being processed asynchronously, or deny access to legitimate uploaded files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RPD-4310; https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RPD-4310
CVE: CVE-2020-4127
Published: 2020-11-30
Description: HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into accessing a system under another ID or use an intranet user's system to access internal systems from the internet. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085409; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085409
CVE: CVE-2020-14193
Published: 2020-11-30
Description: Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are those before version 7.1.15.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: https://jira.atlassian.com/browse/JIRAAUTOSERVER-185; https://jira.atlassian.com/browse/JIRAAUTOSERVER-185
CVE: CVE-2020-4126
Published: 2020-12-01
Description: HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-311
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085411; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085411
CVE: CVE-2020-4129
Published: 2020-12-01
Description: HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVSS Score: 5.3 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085407; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085407
CVE: CVE-2020-9115
Published: 2020-12-01
Description: ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en
CVE: CVE-2020-9116
Published: 2020-12-01
Description: Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201118-01-fusioncompute-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201118-01-fusioncompute-en
CVE: CVE-2020-9114
Published: 2020-12-01
Description: FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201118-01-privilege-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201118-01-privilege-en
CVE: CVE-2020-9117
Published: 2020-12-01
Description: HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected products. Due to insufficient validation of packet, which may be exploited to cause the information leakage or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-outofboundread-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-outofboundread-en
CVE: CVE-2020-15257
Published: 2020-12-01
Description: containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-669, CWE-669
References: https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad; https://github.com/containerd/containerd/releases/tag/v1.4.3; https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4
CVE: CVE-2020-7335
Published: 2020-12-01
Description: Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS103089; https://www.zerodayinitiative.com/advisories/ZDI-20-1388/; http://service.mcafee.com/FAQDocument.aspx?&id=TS103089
CVE: CVE-2020-4128
Published: 2020-12-01
Description: HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service.
CVSS Score: 5.3 (MEDIUM)
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085408; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085408
CVE: CVE-2020-25177
Published: 2020-12-01
Description: WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01
CVE: CVE-2020-25181
Published: 2020-12-01
Description: WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-125
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-310-01
CVE: CVE-2020-26762
Published: 2020-12-01
Description: A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorized attacker to perform remote-code-execution due to a crafted GET-Request. The overflow occurs in binary ipcam_cgi due to a missing type check in function doGetSysteminfo(). This has been fixed in version: IC-3116W v3.08.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.edimax.com/edimax/download/download/data/edimax/de/download/for_home/home_network_cameras/home_network_cameras_indoor_fixed/ic-3116w; https://www.edimax.com/edimax/download/download/data/edimax/de/download/for_home/home_network_cameras/home_network_cameras_indoor_fixed/ic-3116w
CVE: CVE-2020-7533
Published: 2020-12-01
Description: CWE-287: Improper Authentication vulnerability exists which could cause the execution of
commands on the webserver without authentication when sending specially crafted HTTP
requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Notice; https://www.se.com/ww/en/download/document/SEVD-2020-287-01/
CVE: CVE-2020-7545
Published: 2020-12-01
Description: A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://www.se.com/ww/en/download/document/SEVD-2020-287-04/; https://www.se.com/ww/en/download/document/SEVD-2020-287-04/
CVE: CVE-2020-7546
Published: 2020-12-01
Description: A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2020-287-04/; https://www.se.com/ww/en/download/document/SEVD-2020-287-04/
CVE: CVE-2020-7547
Published: 2020-12-01
Description: A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow a user the ability to perform actions via the web interface at a higher privilege level.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.se.com/ww/en/download/document/SEVD-2020-287-04/; https://www.se.com/ww/en/download/document/SEVD-2020-287-04/
CVE: CVE-2020-7548
Published: 2020-12-01
Description: A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information) that could allow unauthorized users to login.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://www.se.com/ww/en/download/document/SEVD-2020-287-03/; https://www.se.com/ww/en/download/document/SEVD-2020-287-03/
CVE: CVE-2020-28940
Published: 2020-12-01
Description: On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allow an unauthenticated user to execute privileged commands on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads; https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-06-115; https://www.zerodayinitiative.com/advisories/ZDI-20-1445/
CVE: CVE-2020-28970
Published: 2020-12-01
Description: An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie. (In addition, an upload endpoint could then be used by an authenticated administrator to upload executable PHP scripts.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads; https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-06-115; https://www.zerodayinitiative.com/advisories/ZDI-20-1448/
CVE: CVE-2020-28971
Published: 2020-12-01
Description: An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.wdc.com/downloads.aspx?g=907&lang=en#downloads; https://www.westerndigital.com/support/productsecurity/wdc-20009-os5-firmware-5-06-115; https://www.zerodayinitiative.com/advisories/ZDI-20-1447/
CVE: CVE-2020-28993
Published: 2020-12-01
Description: A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0. Successful exploitation of this vulnerability would allow an unauthenticated attacker to retrieve administrator credentials by sending a malicious POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://atx.com/products/commercial-services-gateways/minicmts200a-broadband-gateway/; https://www.exploit-db.com/exploits/49124; https://atx.com/products/commercial-services-gateways/minicmts200a-broadband-gateway/
CVE: CVE-2020-6880
Published: 2020-12-01
Description: A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the device does not properly filter parameters, successful use can obtain management rights. This affects: ZXV10 W908 all versions before MIPS_A_1022IPV6R3T6P7Y20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.zxelink.com.cn/website/html/CommonContent.html?classify=news&id=43&menuID=[PII_REDACTED]3313319; http://www.zxelink.com.cn/website/html/CommonContent.html?classify=news&id=43&menuID=[PII_REDACTED]3313319
CVE: CVE-2020-11990
Published: 2020-12-01
Description: We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead the victim to install) a specially crafted (or malicious) Android application would be able to access pictures taken with the app externally.
CVSS Score: 3.3 (LOW)
References: http://jvn.jp/en/jp/JVN59779918/index.html; https://cordova.apache.org/news/2020/09/18/camera-plugin-release.html; http://jvn.jp/en/jp/JVN59779918/index.html
CVE: CVE-2020-29315
Published: 2020-12-01
Description: ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/zoujingli/ThinkAdmin/issues/255; https://github.com/zoujingli/ThinkAdmin/issues/255
CVE: CVE-2019-16958
Published: 2020-12-01
Description: Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.esecforte.com/cross-site-scripting-vulnerability-with-solarwinds-web-help-desk/; https://www.solarwinds.com/free-tools/free-help-desk-software; https://www.esecforte.com/cross-site-scripting-vulnerability-with-solarwinds-web-help-desk/
CVE: CVE-2020-8539
Published: 2020-12-01
Description: Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3; https://sowhat.iit.cnr.it/pdf/IIT-20-2020.pdf; https://gist.github.com/gianpyc/4dc8b0d0c29774a10a97785711e325c3