deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56200
Published: 2024-12-19
Description: Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-405
References: https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600; https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8; https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv
CVE: CVE-2024-12111
Published: 2024-12-19
Description: In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication bypass. This issue affects Privileged Access Manager version 23.3(4.4); 24.3(4.5)
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://www.netiq.com/documentation/privileged-access-manager-45/npam_45_releasenotes/data/npam_45_releasenotes.html; https://www.netiq.com/documentation/privileged-account-manager-44/npam_44_releasenotes/data/npam_44_releasenotes.html
CVE: CVE-2024-49765
Published: 2024-12-19
Description: Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest version of Discourse. Users unable to upgrade who are using discourse connect may disable all other login methods as a workaround.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-359
References: https://github.com/discourse/discourse/security/advisories/GHSA-v8rf-pvgm-xxf2
CVE: CVE-2024-52589
Published: 2024-12-19
Description: Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from untrusted users.
CVSS Score: 2.2 (LOW)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-cqw6-rr3v-8fff
CVE: CVE-2024-52794
Published: 2024-12-19
Description: Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/discourse/discourse/security/advisories/GHSA-m3v4-v2rp-hfm9
CVE: CVE-2024-53991
Published: 2024-12-19
Description: Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileStore::LocalStore` which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick nginx into sending the Discourse backup file with a well crafted request. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. Users unable to upgrade can either 1. Download all local backups on to another storage device, disable the `enable_backups` site setting and delete all backups until the site has been upgraded to pull in the fix. Or  2. Change the `backup_location` site setting to `s3` so that backups are stored and downloaded directly from S3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/discourse/discourse/security/advisories/GHSA-567m-82f6-56rv
CVE: CVE-2024-7137
Published: 2024-12-19
Description: The L2CAP receive data buffer for L2CAP packets is restricted to packet sizes smaller than the maximum supported packet size. Receiving a packet that exceeds the restricted buffer length may cause a crash. A hard reset is required to recover the crashed device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://community.silabs.com/068Vm00000I5mjD
CVE: CVE-2024-7138
Published: 2024-12-19
Description: An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://community.silabs.com/068Vm00000I5mjD
CVE: CVE-2024-7139
Published: 2024-12-19
Description: Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. 

If a watchdog timer is not enabled, a hard reset is required to recover the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-787
References: https://community.silabs.com/068Vm00000I5mjD
CVE: CVE-2024-11157
Published: 2024-12-19
Description: A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
CVE: CVE-2024-11364
Published: 2024-12-19
Description: Another “uninitialized variable” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to access a variable prior to it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVSS Score: 7.3 (HIGH)
CWE: CWE-908, CWE-908
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
CVE: CVE-2024-12175
Published: 2024-12-19
Description: Another “use after free” code execution vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to craft a DOE file and force the software to use a resource that was already used. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
CVE: CVE-2024-12672
Published: 2024-12-19
Description: A third-party vulnerability exists in the Rockwell Automation Arena® that could allow a threat actor to write beyond the boundaries of allocated memory in a DOE file. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1713.html
CVE: CVE-2024-12727
Published: 2024-12-19
Description: A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE: CVE-2024-12728
Published: 2024-12-19
Description: A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1391
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE: CVE-2024-12729
Published: 2024-12-19
Description: A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1).
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce
CVE: CVE-2024-2201
Published: 2024-12-19
Description: A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.
CVSS Score: 4.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2024/04/09/15; http://www.openwall.com/lists/oss-security/2024/05/07/7; http://xenbits.xen.org/xsa/advisory-456.html
CVE: CVE-2024-54982
Published: 2024-12-19
Description: An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. NOTE: Quectel disputes this because the issue is in the chipset supply chain and is not localized to one or more Quectel products.
References: https://github.com/haroldfeng/nbiot-va/blob/master/Quectel_BC25_Subscriber_Auth_Bypass.md
CVE: CVE-2024-54983
Published: 2024-12-19
Description: An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/haroldfeng/nbiot-va/blob/master/Quecctel_BC95-CNV_Message_Auth_Bypass.md
CVE: CVE-2024-54984
Published: 2024-12-19
Description: An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/haroldfeng/nbiot-va/blob/master/Quecctel_BG96_Message_Auth_Bypass.md
CVE: CVE-2024-12700
Published: 2024-12-19
Description: There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell and execute code with the privileges of user running the web server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://aggregate.digital/downloads.html; https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-05
CVE: CVE-2024-54009
Published: 2024-12-19
Description: Remote authentication bypass vulnerability in HPE Alletra Storage MP B10000 in versions prior to version 10.4.5 could be remotely exploited to allow disclosure of information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04764en_us&docLocale=en_US
CVE: CVE-2024-54663
Published: 2024-12-19
Description: An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
CVSS Score: 7.5 (HIGH)
CWE: CWE-829
References: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes
CVE: CVE-2024-56327
Published: 2024-12-19
Description: pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c; https://github.com/advisories/GHSA-4fg7-vxc8-qx5w; https://github.com/woodruffw/pyrage/security/advisories/GHSA-47h8-jmp3-9f28
CVE: CVE-2024-12829
Published: 2024-12-20
Description: Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ExecManagerImpl class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24015.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1717/
CVE: CVE-2024-12830
Published: 2024-12-20
Description: Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the custom_handler method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-24019.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1718/
CVE: CVE-2024-12831
Published: 2024-12-20
Description: Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the uvm_login module. The issue results from incorrect authorization. An attacker can leverage this to escalate privileges to resources normally protected from the user. Was ZDI-CAN-24324.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1720/
CVE: CVE-2024-12832
Published: 2024-12-20
Description: Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability.

The specific flaw exists within the ReportEntry class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the www-data user. Was ZDI-CAN-24325.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1719/
CVE: CVE-2024-54538
Published: 2024-12-20
Description: A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. A remote attacker may be able to cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2020-9250
Published: 2024-12-20
Description: There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. (Vulnerability ID: HWPSIRT-2019-12302)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9250.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-522
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200729-01-smartphone-en
CVE: CVE-2022-32144
Published: 2024-12-20
Description: There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. (Vulnerability ID: HWPSIRT-2022-76192)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32144.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-346
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-66843eb3-en
CVE: CVE-2024-12678
Published: 2024-12-20
Description: Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-allocations-vulnerable-to-privilege-escalation-within-a-namespace-using-unredacted-workload-identity-token/72119
CVE: CVE-2022-32203
Published: 2024-12-20
Description: There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in the highest privileges of the printer. (Vulnerability ID: HWPSIRT-2022-51773)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32203.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220601-01-6b47c6b6-en
CVE: CVE-2022-32204
Published: 2024-12-20
Description: There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. (Vulnerability ID: HWPSIRT-2022-87185)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-32204.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220608-01-1a91f8a4-en
CVE: CVE-2022-34159
Published: 2024-12-20
Description: Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. (Vulnerability ID: HWPSIRT-2022-80078)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-34159.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220620-01-6e028b61-en
CVE: CVE-2024-11776
Published: 2024-12-20
Description: The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/pcrecruiter-extensions/trunk/PCRecruiter-Extensions.php#L21; https://www.wordfence.com/threat-intel/vulnerabilities/id/d97e1ec3-321b-4d69-ab69-e3ecab0937b3?source=cve
CVE: CVE-2023-42867
Published: 2024-12-20
Description: This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-281
References: https://support.apple.com/en-us/120299; https://support.apple.com/kb/HT214042
CVE: CVE-2024-44195
Published: 2024-12-20
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44211
Published: 2024-12-20
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-281
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44223
Published: 2024-12-20
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to a Mac may be able to view protected content from the Login Window.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-281
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44231
Published: 2024-12-20
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. A person with physical access to a Mac may be able to bypass Login Window during a software update.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44292
Published: 2024-12-20
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922, CWE-922
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44293
Published: 2024-12-20
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. A user may be able to view sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-352
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-44298
Published: 2024-12-20
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access information about a user's contacts.
CVSS Score: 3.3 (LOW)
CWE: CWE-922, CWE-922
References: https://support.apple.com/en-us/121564; http://seclists.org/fulldisclosure/2024/Oct/11
CVE: CVE-2024-21549
Published: 2024-12-20
Description: Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file.**Note:**This is a bypass of the fix for [CVE-2024-21544](https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8496745).
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: https://github.com/spatie/browsershot/commit/f791ce0ae8dd99367dbfa30588ee31e1196e1728; https://github.com/spatie/browsershot/discussions/906; https://security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023
CVE: CVE-2024-10555
Published: 2024-12-20
Description: The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fcc97635-e939-4cb4-9851-6f6ac4f6ad47/