deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-10977
Published: 2024-11-14
Description: Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application.  For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistakes for valid query results.  This is probably not a concern for clients where the user interface unambiguously indicates the boundary between one error message and other text.  Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Score: 3.1 (LOW)
CWE: CWE-348, CWE-345
References: https://www.postgresql.org/support/security/CVE-2024-10977/; https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
CVE: CVE-2024-10978
Published: 2024-11-14
Description: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended.  An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature.  The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker.  If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION.  The attacker does not control which incorrect user ID applies.  Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries.  Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-266
References: https://www.postgresql.org/support/security/CVE-2024-10978/; https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html; https://lists.debian.org/debian-lts-announce/2024/11/msg00018.html
CVE: CVE-2024-10979
Published: 2024-11-14
Description: Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH).  That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user.  Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-15, CWE-610
References: https://www.postgresql.org/support/security/CVE-2024-10979/; https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md; https://lists.debian.org/debian-lts-announce/2024/11/msg00011.html
CVE: CVE-2024-11207
Published: 2024-11-14
Description: A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login. The manipulation of the argument redirect_uri leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://gist.github.com/0xArthurSouza/68295d8fa20f[PII_REDACTED]fcdf842a2; https://vuldb.com/?ctiid.284521; https://vuldb.com/?id.284521
CVE: CVE-2024-7404
Published: 2024-11-14
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1021
References: https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery; https://gitlab.com/gitlab-org/gitlab/-/issues/476670; https://hackerone.com/reports/2627925
CVE: CVE-2024-8648
Published: 2024-11-14
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#stored-xss-through-javascript-url-in-analytics-dashboards; https://gitlab.com/gitlab-org/gitlab/-/issues/486220; https://hackerone.com/reports/2683863
CVE: CVE-2024-10962
Published: 2024-11-14
Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.9.107 via deserialization of untrusted input in the 'replace_row_data' and 'replace_serialize_data' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site to trigger the exploit.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging-copy-db-ex.php#L1104; https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging-copy-db-ex.php#L1120; https://plugins.trac.wordpress.org/changeset/3186082/
CVE: CVE-2024-11208
Published: 2024-11-14
Description: A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-613
References: https://gist.github.com/0xArthurSouza/ce3b89887b03cc899d5e8cb6e472b04e; https://ibb.co/1LxSK2k; https://vuldb.com/?ctiid.284522
CVE: CVE-2024-11209
Published: 2024-11-14
Description: A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287, CWE-287
References: https://gist.github.com/0xArthurSouza/281e8ea8a797abc8371a8ced31dc5562; https://vuldb.com/?ctiid.284523; https://vuldb.com/?id.284523
CVE: CVE-2024-11215
Published: 2024-11-14
Description: Absolute path traversal (incorrect restriction of a path to a restricted directory) vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only consecutive strings ‘/...%5c’.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-easyphp
CVE: CVE-2024-50839
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the subject_code and title parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Subject.pdf
CVE: CVE-2024-50840
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the class_name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Class.pdf
CVE: CVE-2024-50841
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the date_start, date_end, and title parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Calendar%20of%20Events.pdf
CVE: CVE-2024-50842
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the school_year parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20School%20Year.pdf
CVE: CVE-2024-50843
Published: 2024-11-14
Description: A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access sensitive files and directories via /loginsystem/assets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20&%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Directory%20listings.md
CVE: CVE-2024-9633
Published: 2024-11-14
Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.
CVSS Score: 3.1 (LOW)
CWE: CWE-708
References: https://gitlab.com/gitlab-org/gitlab/-/issues/498257; https://hackerone.com/reports/2759470
CVE: CVE-2022-2232
Published: 2024-11-14
Description: A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://access.redhat.com/errata/RHSA-2024:0094; https://access.redhat.com/errata/RHSA-2024:0095; https://access.redhat.com/errata/RHSA-2024:0096
CVE: CVE-2024-11210
Published: 2024-11-14
Description: A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/FilemanagerLogic.php. The manipulation of the argument activepath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/nn0nkey/nn0nkey/blob/main/eyoucms/mlcy.md; https://vuldb.com/?ctiid.284525; https://vuldb.com/?id.284525
CVE: CVE-2024-11211
Published: 2024-11-14
Description: A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/falling-snow1/cve/blob/main/EyouCMS_RCE.md; https://vuldb.com/?ctiid.284526; https://vuldb.com/?id.284526
CVE: CVE-2024-11212
Published: 2024-11-14
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/fetch_product_details.php. The manipulation of the argument barcode leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/physicszq/web_issue/blob/main/Management/sql_injection01.md; https://vuldb.com/?ctiid.284528; https://vuldb.com/?id.284528
CVE: CVE-2024-50837
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and username parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20admin%20user.pdf
CVE: CVE-2024-50838
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the d and pi parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-120
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Department.pdf
CVE: CVE-2024-7124
Published: 2024-11-14
Description: Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects DInGO dLibra software in versions from 6.0 before 6.3.20.
CWE: CWE-79
References: https://cert.pl/en/posts/2024/11/CVE-2024-7124/; https://cert.pl/posts/2024/11/CVE-2024-7124/; https://dingo.psnc.pl/dlibra/
CVE: CVE-2024-10921
Published: 2024-11-14
Description: An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-158
References: https://jira.mongodb.org/browse/SERVER-96419
CVE: CVE-2024-11136
Published: 2024-11-14
Description: The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage.
CWE: CWE-35
References: https://blog.oversecured.com/Content-Providers-and-the-potential-weak-spots-they-can-have/#path-traversal-when-using-data-from-uri; https://cert.pl/en/posts/2024/11/CVE-2024-11136/; https://cert.pl/posts/2024/11/CVE-2024-11136/
CVE: CVE-2024-11213
Published: 2024-11-14
Description: A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /admin/edit_role.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sh3rl0ckpggp/0day/blob/main/authenticated_sqli_Employee_management_system.md; https://vuldb.com/?ctiid.284529; https://vuldb.com/?id.284529
CVE: CVE-2024-11214
Published: 2024-11-14
Description: A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/sh3rl0ckpggp/0day/blob/main/Employee_management%20_system_RCE.md; https://vuldb.com/?ctiid.284530; https://vuldb.com/?id.284530
CVE: CVE-2024-42188
Published: 2024-11-14
Description: HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
CVSS Score: 3.7 (LOW)
CWE: CWE-276
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117387
CVE: CVE-2024-52302
Published: 2024-11-14
Description: common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper validation or restrictions, enabling attackers to upload malicious files that can lead to Remote Code Execution (RCE).
CWE: CWE-434
References: https://github.com/OsamaTaher/Java-springboot-codebase/commit/204402bb8b68030c14911379ddc82cfff00b8538; https://github.com/OsamaTaher/Java-springboot-codebase/security/advisories/GHSA-rhcq-44g3-5xcx
CVE: CVE-2024-52505
Published: 2024-11-14
Description: matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-147
References: https://github.com/matrix-org/matrix-appservice-irc/commit/4a024eae1a992b1ea67e71a998e0b833b54221e2; https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c3hj-hg7p-rrq5
CVE: CVE-2024-37285
Published: 2024-11-14
Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific  Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and  Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them.



The following Elasticsearch indices permissions are required

  *  write privilege on the system indices .kibana_ingest*
  *  The allow_restricted_indices flag is set to true


Any of the following Kibana privileges are additionally required

  *  Under Fleet the All privilege is granted
  *  Under Integration the Read or All privilege is granted
  *  Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119
CVE: CVE-2024-50832
Published: 2024-11-14
Description: A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20edit%20class.pdf
CVE: CVE-2024-50833
Published: 2024-11-14
Description: A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20login%20page.pdf
CVE: CVE-2024-50834
Published: 2024-11-14
Description: A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20teacher.pdf
CVE: CVE-2024-50835
Published: 2024-11-14
Description: A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln, fn, and id parameters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit%20student.pdf
CVE: CVE-2024-50836
Published: 2024-11-14
Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and lastname parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Teachers.pdf
CVE: CVE-2024-6068
Published: 2024-11-14
Description: A memory corruption vulnerability exists in the affected products when parsing DFT files.  Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DFT file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1284
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD17011.html
CVE: CVE-2024-1682
Published: 2024-11-14
Description: An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/psf/requests/commit/6106a63eb6c0fa490efa73d44388ac25b1b08af4; https://huntr.com/bounties/4da5ded5-b59b-4ece-8812-46a4329e446c
CVE: CVE-2024-3379
Published: 2024-11-14
Description: In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projects they do not have access to. Specifically, a user with a 'Member' role can issue a request to regenerate the private key of a project without having the necessary permissions or being assigned to that project. This issue was fixed in version 1.2.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54; https://huntr.com/bounties/739df024-a112-47aa-b51d-988c3f855e92
CVE: CVE-2024-3501
Published: 2024-11-14
Description: In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated.
CVSS Score: 8.1 (HIGH)
CWE: CWE-922, CWE-922
References: https://github.com/lunary-ai/lunary/commit/17e95f6c99c7d5ac4ee5451c5857b97a12892c74; https://huntr.com/bounties/8fdfdb9d-10bd-4f00-8004-d5baabc20c6e