deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-vx9j-46rh-fqr8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, <= 3.2.22.1
Patched in: 3.2.22.2

Summary: actionview contains Path Traversal vulnerability

Details:
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!
GitHub Security Advisory: GHSA-m46p-ggm5-5j83
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.3
Patched in: 4.0.3

Summary: Rails vulnerable to Cross-site Scripting

Details:
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
GitHub Security Advisory: GHSA-m46p-ggm5-5j83
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.2.17
Patched in: 3.2.17

Summary: Rails vulnerable to Cross-site Scripting

Details:
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
GitHub Security Advisory: GHSA-gqvf-892r-vjm5
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 5.5.19
Patched in: 5.5.19

Summary: Improper Certificate Validation in Puppet

Details:
Previously, Puppet operated on the model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.
GitHub Security Advisory: GHSA-gqvf-892r-vjm5
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: >= 6.0.0, < 6.13.0
Patched in: 6.13.0

Summary: Improper Certificate Validation in Puppet

Details:
Previously, Puppet operated on the model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.
GitHub Security Advisory: GHSA-62qp-3fxm-9wxf
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.6.0, < 1.6.1
Patched in: 1.6.1

Summary: Nokogiri vulnerable to DoS while parsing XML documents

Details:
Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
GitHub Security Advisory: GHSA-62qp-3fxm-9wxf
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.5.0, < 1.5.11
Patched in: 1.5.11

Summary: Nokogiri vulnerable to DoS while parsing XML documents

Details:
Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
GitHub Security Advisory: GHSA-jmhh-w7xp-wg39
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.6.0, < 1.6.1
Patched in: 1.6.1

Summary: Nokogiri vulnerable to DoS while parsing XML entities

Details:
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
GitHub Security Advisory: GHSA-jmhh-w7xp-wg39
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.5.0, < 1.5.11
Patched in: 1.5.11

Summary: Nokogiri vulnerable to DoS while parsing XML entities

Details:
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
GitHub Security Advisory: GHSA-j436-h7hm-rx46
Package: facter (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 1.6.0, < 2.4.1
Patched in: 2.4.1

Summary: Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata

Details:
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
GitHub Security Advisory: GHSA-r364-2pj4-pf7f
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 1.0.0
Patched in: 1.0.0

Summary: ruby-saml vulnerable to XPath injection

Details:
`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
GitHub Security Advisory: GHSA-xxr8-833v-c7wc
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.1.0, < 3.1.2
Patched in: 3.1.2

Summary: Cross-site Scripting vulnerability in i18n translations helper method

Details:
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
GitHub Security Advisory: GHSA-xxr8-833v-c7wc
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.11
Patched in: 3.0.11

Summary: Cross-site Scripting vulnerability in i18n translations helper method

Details:
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
GitHub Security Advisory: GHSA-x487-866m-p8hr
Package: camaleon_cms (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 2.7.4
Patched in: 2.7.4

Summary: Server-Side Template Injection in Camaleon CMS

Details:
Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the `formats` parameter.
GitHub Security Advisory: GHSA-24fg-p96v-hxh8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 3.0.0, < 3.0.4
Patched in: 3.0.4

Summary: actionpack Cross-Site Request Forgery vulnerability

Details:
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
GitHub Security Advisory: GHSA-24fg-p96v-hxh8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 2.1.0, < 2.3.11
Patched in: 2.3.11

Summary: actionpack Cross-Site Request Forgery vulnerability

Details:
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
GitHub Security Advisory: GHSA-fg9w-g6m4-557j
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.3.0, < 2.3.4
Patched in: 2.3.4

Summary: actionpack and activesupport vulnerable to information leaks

Details:
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
GitHub Security Advisory: GHSA-fg9w-g6m4-557j
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.1.0, < 2.2.3
Patched in: 2.2.3

Summary: actionpack and activesupport vulnerable to information leaks

Details:
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
GitHub Security Advisory: GHSA-8fqx-7pv4-3jwm
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.2.0, < 2.2.2
Patched in: 2.2.2

Summary: Improper Input Validation in actionpack

Details:
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
GitHub Security Advisory: GHSA-8fqx-7pv4-3jwm
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.1.0, < 2.1.3
Patched in: 2.1.3

Summary: Improper Input Validation in actionpack

Details:
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
GitHub Security Advisory: GHSA-gjxw-5w2q-7grf
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, < 3.0.1
Patched in: 3.0.1

Summary: Rails activerecord gem has Improper Input Validation vulnerability

Details:
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
GitHub Security Advisory: GHSA-gjxw-5w2q-7grf
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.3.9, < 2.3.10
Patched in: 2.3.10

Summary: Rails activerecord gem has Improper Input Validation vulnerability

Details:
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
GitHub Security Advisory: GHSA-xf96-32q2-9rw2
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.1.1
Patched in: 2.1.1

Summary: Rails ActiveRecord gem vulnerable to SQL injection

Details:
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) `:limit` and (2) `:offset` parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
GitHub Security Advisory: GHSA-75w6-p6mg-vh8j
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.4
Patched in: 3.0.4

Summary: Rails actionpack gem vulnerable to Cross-site Scripting

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
GitHub Security Advisory: GHSA-75w6-p6mg-vh8j
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.11
Patched in: 2.3.11

Summary: Rails actionpack gem vulnerable to Cross-site Scripting

Details:
Multiple cross-site scripting (XSS) vulnerabilities in the `mail_to` helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
GitHub Security Advisory: GHSA-xgww-h98f-24qf
Package: metasploit-framework (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 4.19.0
Patched in: 4.19.0

Summary: Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module

Details:
By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.
GitHub Security Advisory: GHSA-228f-g3h7-3fj3
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.8.23
Patched in: 1.8.23

Summary: RubyGems HTTPS to HTTP redirect

Details:
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
GitHub Security Advisory: GHSA-5mgj-mvv8-46mw
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.8.23
Patched in: 1.8.23

Summary: RubyGems does not verify SSL certificate

Details:
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
GitHub Security Advisory: GHSA-qv62-xfj6-32xm
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.3.0, < 2.4.8
Patched in: 2.4.8

Summary: RubyGems Improper Input Validation vulnerability

Details:
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."

NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.
GitHub Security Advisory: GHSA-qv62-xfj6-32xm
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.1.0.rc.1, < 2.2.5
Patched in: 2.2.5

Summary: RubyGems Improper Input Validation vulnerability

Details:
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."

NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.
GitHub Security Advisory: GHSA-qv62-xfj6-32xm
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.0.17
Patched in: 2.0.17

Summary: RubyGems Improper Input Validation vulnerability

Details:
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."

NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.