deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9xc6-c2rm-f27p
Package: org.xwiki.rendering:xwiki-rendering-xml (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Vulnerable versions: < 16.10.10
Patched in: 16.10.10

Summary: XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Details:
### Impact
Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as content of HTML macros with insufficient escaping, and it is thus possible to close the HTML macro and inject script macros that are executed with programming rights. To demonstrate, the content `{{html}}{{/html {{/html}}}}` can be inserted into any field of the user profile that supports wiki syntax like the "About" field. If this leads to the display of raw HTML, the instance is vulnerable.

### Patches
This problem has been patched by extending the escaping introduced by [XRENDERING-693](https://jira.xwiki.org/browse/XRENDERING-693) to also cover closing HTML macros that have spaces after the macro name in XWiki 16.10.10, 17.4.3 and 17.6.0RC1. A [similar fix](https://github.com/xwiki/xwiki-platform/commit/12b780ccd5bca5fc8f74f46648d7e02fa04fbc11) has been applied in `org.xwiki.platform:xwiki-platform-oldcore` as an extra safety net, see [XWIKI-23378](https://jira.xwiki.org/browse/XWIKI-23378). At this point, we're not aware that this extra safety net would be required for security.

The patch also fixes the injection of opening HTML macro syntaxes, e.g., with `{{html}}{{html{{/html}}}}` which disrupts the rendering of the user profile but for which we haven't found any further security impact apart from the disruption of the UI.

### Workarounds
We're not aware of any workarounds except for upgrading the affected module to a version with a fix.
GitHub Security Advisory: GHSA-cc84-q3v3-mhgf
Package: org.xwiki.platform:xwiki-platform-rest-server (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.5.0-rc-1, < 17.7.0-rc-1
Patched in: 17.7.0-rc-1

Summary: XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

Details:
### Impact
XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages.

### Patches
XWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now.

### Workarounds
We're not aware of any workaround, except denying access to the affected REST resources in a proxy in front of XWiki.
GitHub Security Advisory: GHSA-cc84-q3v3-mhgf
Package: org.xwiki.platform:xwiki-platform-rest-server (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.4
Patched in: 17.4.4

Summary: XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

Details:
### Impact
XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages.

### Patches
XWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now.

### Workarounds
We're not aware of any workaround, except denying access to the affected REST resources in a proxy in front of XWiki.
GitHub Security Advisory: GHSA-cc84-q3v3-mhgf
Package: org.xwiki.platform:xwiki-platform-rest-server (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 16.10.11
Patched in: 16.10.11

Summary: XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis

Details:
### Impact
XWiki's REST API doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of pages in the wiki and the memory configuration, this can lead to slowness and unavailability of the wiki. As an example, the `/rest/wikis/xwiki/spaces` resource returns all spaces on the wiki by default, which are basically all pages.

### Patches
XWiki 17.7.0RC1, 17.4.4 and 16.10.11 introduce a configurable limit, limiting responses to 1000 items by default. Requesting larger limits leads to an error now.

### Workarounds
We're not aware of any workaround, except denying access to the affected REST resources in a proxy in front of XWiki.
GitHub Security Advisory: GHSA-7vpr-jm38-wr7w
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.2
Patched in: 17.4.2

Summary: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Details:
### Impact
A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.

### Patches
This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd[PII_REDACTED]d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
GitHub Security Advisory: GHSA-7vpr-jm38-wr7w
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 6.2-milestone-1, < 16.10.10
Patched in: 16.10.10

Summary: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Details:
### Impact
A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.

### Patches
This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd[PII_REDACTED]d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
GitHub Security Advisory: GHSA-7vpr-jm38-wr7w
Package: org.xwiki.platform:xwiki-platform-flamingo-skin-resources (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.2
Patched in: 17.4.2

Summary: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Details:
### Impact
A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.

### Patches
This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd[PII_REDACTED]d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
GitHub Security Advisory: GHSA-7vpr-jm38-wr7w
Package: org.xwiki.platform:xwiki-platform-flamingo-skin-resources (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 6.2-milestone-1, < 16.10.10
Patched in: 16.10.10

Summary: XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Details:
### Impact
A reflected XSS vulnerability in XWiki allows an attacker to send a victim to a URL with a deletion confirmation message on which the attacker-supplied script is executed when the victim clicks the "No" button. When the victim has admin or programming right, this allows the attacker to execute basically arbitrary actions on the XWiki installation including remote code execution.

### Patches
This vulnerability has been patched in XWiki 16.10.10, 17.4.2 and 17.5.0 by using the affected URL parameter only in the intended context.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/cb578b1b2910d06e9dd[PII_REDACTED]d1cfbd280f2) can be manually applied to the templates that are present in the WAR. A restart of XWiki is needed for the changes to be applied.
GitHub Security Advisory: GHSA-2mxr-rc97-xrj2
Package: net.sf.robocode:robocode.battle (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: < 1.9.5.6
Patched in: 1.9.5.6

Summary: Robocode has an insecure temporary file creation vulnerability in the AutoExtract component

Details:
An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.
GitHub Security Advisory: GHSA-j8r2-47rx-qhw4
Package: net.sf.robocode:robocode.core (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.9.5.6
Patched in: 1.9.5.6

Summary: Robocode vulnerable to Directory Traversal in recursivelyDelete Method

Details:
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.
GitHub Security Advisory: GHSA-93fv-4pm9-xp28
Package: net.dv8tion:JDA (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 6.0.0, < 6.1.3
Patched in: 6.1.3

Summary: JDA (Java Discord API) downloads external URLs when updating message components

Details:
### Impact

Anyone using untrusted message components may be affected. On versions >=6.0.0,<6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request.

If you are used `Message#getComponents` or similar to get a list of components and then send those components with `sendMessageComponents` or other methods, you might unintentionally download media from an external URL in the resolved media of a `Thumbnail`, `FileDisplay`, or `MediaGallery`.

### Patches

This bug has been fixed in 6.1.3, and we recommend updating.

### Workarounds

Avoid sending components from untrusted messages or update to version 6.1.3.
GitHub Security Advisory: GHSA-xrhh-hx36-485q
Package: io.strimzi:strimzi (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-863: Incorrect Authorization
Vulnerable versions: >= 0.47.0, < 0.49.1
Patched in: 0.49.1

Summary: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Details:
### Impact

In some situations, Strimzi creates an incorrect Kubernetes `Role` which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands the `GET` access to all Kubernetes Secrets that exist in the given Kubernetes namespace. The exact scenario when this happens is when:
* Apache Kafka Connect is deployed without at least one of the following options configured:
    * TLS encryption with configured trusted certificates (no `.spec.tls.trustedCertificates` section in the `KafkaConnect` CR)
    * mTLS authentication (no `type: tls` in `.spec.authentication` section of the `KafkaConnect` CR)
    * TLS encryption with configured trusted certificates for `type: oauth` authentication (no `.spec.authentication.tlsTrustedCertificates` section in the `KafkaConnect` CR)
* Apache Kafka MirrorMaker2 is deployed without at least one of the following options configured for the target cluster:
    * TLS encryption with configured trusted certificates (no `.spec.target.tls.trustedCertificates` section in the `KafkaConnect` CR)
    * mTLS authentication (no `type: tls` in `.spec.target.authentication` section of the `KafkaConnect` CR)
    * TLS encryption with configured trusted certificates for `type: oauth` authentication (no `.spec.target.authentication.tlsTrustedCertificates` section in the `KafkaConnect` CR)
    * TLS encryption with configured trusted certificates (no `.spec.clusters[].tls.trustedCertificates` section in the `KafkaConnect` CR for the target cluster)
    * mTLS authentication (no `type: tls` in `.spec.clusters[].authentication` section of the `KafkaConnect` CR for the target cluster)
    * TLS encryption with configured trusted certificates for `type: oauth` authentication (no `.spec.clusters[].authentication.tlsTrustedCertificates` section in the `KafkaConnect` CR for the target cluster)

When the operands configured as described above are deployed with Strimzi >= 0.47.0 and <= 0.49.0, any code running within their Pods and using their Service Account for authentication will be able to `GET` any Kubernetes Secret from the same namespace. This can be done by executing 3rd party tools from the Pods. Or directly from the Kafka Connect code, for example, using configuration providers or HTTP connectors. The Pods are allowed to only `GET` the Secrets. They are not allowed to list, watch, modify, or delete the Secrets.

### Patches

The issue is fixed in Strimzi 0.49.1.

### Workarounds

There is no workaround for this issue when using the affected operands with the affected configurations.
GitHub Security Advisory: GHSA-v6x2-4q87-rf82
Package: org.apache.skywalking:apm-webapp (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: <= 10.1.0
Patched in: unpatched

Summary: Apache SkyWalking has a stored XSS vulnerability

Details:
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.

This issue affects Apache SkyWalking versions <= 10.2.0.

Users are recommended to upgrade to version 10.3.0, which fixes the issue. Version 10.3.0 has not been uploaded to the Maven registry at time of publish, please see [release notes](https://github.com/apache/skywalking/releases/tag/v10.3.0) for download instructions.
GitHub Security Advisory: GHSA-f58c-gq56-vjjf
Package: org.apache.tika:tika-parser-pdf-module (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.0.0, <= 3.2.1
Patched in: 3.2.2

Summary: Apache Tika has XXE vulnerability

Details:
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. 

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. 

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. 

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
GitHub Security Advisory: GHSA-f58c-gq56-vjjf
Package: org.apache.tika:tika-parsers (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 1.13, < 2.0.0
Patched in: 2.0.0

Summary: Apache Tika has XXE vulnerability

Details:
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. 

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. 

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. 

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
GitHub Security Advisory: GHSA-f58c-gq56-vjjf
Package: org.apache.tika:tika-core (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 1.13, <= 3.2.1
Patched in: 3.2.2

Summary: Apache Tika has XXE vulnerability

Details:
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. 

This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. 

First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. 

Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
GitHub Security Advisory: GHSA-wwq7-pxwc-p4rc
Package: org.apache.axis2:axis2-transport-http (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.8.0
Patched in: 1.8.0

Summary: Apache Axis2 has Improper Input Validation

Details:
Apache Axis2/Java 1.7.9 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
GitHub Security Advisory: GHSA-wwq7-pxwc-p4rc
Package: org.apache.axis2:axis2 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.8.0
Patched in: 1.8.0

Summary: Apache Axis2 has Improper Input Validation

Details:
Apache Axis2/Java 1.7.9 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
GitHub Security Advisory: GHSA-4hr2-xf7w-jf76
Package: com.linecorp.centraldogma:centraldogma-server-auth-shiro (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 0.78.0
Patched in: 0.78.0

Summary: Central Dogma's Login Function Has an Open Redirect Vulnerability

Details:
### Impact
Successful exploitation of this vulnerability could allow an attacker to craft a malicious link that, when clicked by a victim, redirects them to a phishing website designed to mimic the legitimate Central Dogma login page. This could result in the compromise of user accounts and unauthorized access to the Central Dogma instance.

### Patches
This vulnerability is addressed and resolved in Central Dogma version 0.78.0. The server operators who run Central Dogma server with Shiro authentication are strongly encouraged to upgrade to this version or later to mitigate the risk associated with the open redirect vulnerability.

### Workarounds
Implement `AuthProvider` to overrides `webLoginService()`.

### References
- https://cwe.mitre.org/data/definitions/601.html
GitHub Security Advisory: GHSA-fxp5-37mh-vff5
Package: com.blazemeter.plugins:BlazeMeterJenkinsPlugin (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 4.27
Patched in: 4.27

Summary: BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources

Details:
A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.
GitHub Security Advisory: GHSA-3w8q-xq97-5j7x
Package: org.mozilla:rhino (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 1.8.0
Patched in: 1.8.1

Summary: Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

Details:
When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a potential Denial of Service.

Small numbers go through this call stack: `NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult`
where `pow5mult` attempts to raise `5` to a ridiculous power.

Example code: `(4.47118444E-314).toFixed(2)`
GitHub Security Advisory: GHSA-3w8q-xq97-5j7x
Package: org.mozilla:rhino (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.7.15, < 1.7.15.1
Patched in: 1.7.15.1

Summary: Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function

Details:
When an application passed an attacker controlled float poing number into the `toFixed()` function, it might lead to high CPU consumption and a potential Denial of Service.

Small numbers go through this call stack: `NativeNumber.numTo > DToA.JS_dtostr > DToA.JS_dtoa > DToA.pow5mult`
where `pow5mult` attempts to raise `5` to a ridiculous power.

Example code: `(4.47118444E-314).toFixed(2)`