deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10600
Published: 2018-07-24
Description: SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611, CWE-611
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02
CVE: CVE-2018-10604
Published: 2018-07-24
Description: SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02; https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02
CVE: CVE-2018-10608
Published: 2018-07-24
Description: SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://packetstormsecurity.com/files/152951/SEL-AcSELerator-Architect-2.2.24-Denial-Of-Service.html; https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02; http://packetstormsecurity.com/files/152951/SEL-AcSELerator-Architect-2.2.24-Denial-Of-Service.html
CVE: CVE-2018-10905
Published: 2018-07-24
Description: CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-78
References: https://access.redhat.com/errata/RHSA-2018:2561; https://access.redhat.com/errata/RHSA-2018:2745; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10905
CVE: CVE-2018-13385
Published: 2018-07-24
Description: There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-88
References: https://jira.atlassian.com/browse/SRCTREE-5846; https://jira.atlassian.com/browse/SRCTREE-5846
CVE: CVE-2018-13386
Published: 2018-07-24
Description: There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-88
References: https://jira.atlassian.com/browse/SRCTREEWIN-8884; https://jira.atlassian.com/browse/SRCTREEWIN-8884
CVE: CVE-2018-14335
Published: 2018-07-24
Description: An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59, CWE-276
References: https://access.redhat.com/errata/RHSA-2020:0727; https://gist.github.com/owodelta/9714faf9a86435cef5a99d4930eaee20; https://lists.apache.org/thread.html/582d4165de6507b0be82d5a6f9a1ce392ec43a00c9fed32bacf7fe1e%40%3Cuser.ignite.apache.org%3E
CVE: CVE-2018-14579
Published: 2018-07-24
Description: GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for install/install.sql.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/havysec/Useful_Code/blob/master/mycve/001.md; https://github.com/havysec/Useful_Code/blob/master/mycve/001.md
CVE: CVE-2016-5638
Published: 2018-07-24
Description: There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities over the Web GUI and can be accessed even when you are away from home. A remote attacker can access genie_ping.htm or genie_ping2.htm or genie_ping3.htm page without authentication. Once accessed, the page will be redirected to the aCongratulations2.htma page, which reveals some sensitive information such as 2.4GHz & 5GHz Wireless Network Name (SSID) and Network Key (Password) in clear text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-200
References: https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html; https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html
CVE: CVE-2016-5649
Published: 2018-07-24
Description: A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-200
References: http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html; https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html; http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html
CVE: CVE-2017-3180
Published: 2018-07-24
Description: Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0, and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0, and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0, and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://www.securityfocus.com/bid/95699; https://www.tibco.com//support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3180; https://www.securityfocus.com/bid/95699
CVE: CVE-2017-3181
Published: 2018-07-24
Description: Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.securityfocus.com/bid/95696; https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181; https://www.securityfocus.com/bid/95696
CVE: CVE-2017-3182
Published: 2018-07-24
Description: On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications, which aims to provide fraud prevention and device identity capabilities. The ThreatMetrix SDK versions prior to 3.2 do not validate SSL certificates on the iOS platform. An affected application will communicate with https://h-sdk.online-metrix.net, regardless of whether the connection is secure or not. An attacker on the same network as or upstream from the iOS device may be able to view or modify ThreatMetrix network traffic that should have been protected by HTTPS.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://www.kb.cert.org/vuls/id/767208; https://www.securityfocus.com/bid/95360; https://www.kb.cert.org/vuls/id/767208
CVE: CVE-2017-3183
Published: 2018-07-24
Description: Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determined by the USER_CODE field associated with the querying user. By modifying the USER_CODE value to match that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remote, authenticated user can submit specially crafted SQL queries to gain privileged access to the application database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-863
References: https://www.kb.cert.org/vuls/id/742632; https://www.securityfocus.com/bid/96477; https://www.kb.cert.org/vuls/id/742632
CVE: CVE-2017-3187
Published: 2018-07-24
Description: The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/96616; https://www.kb.cert.org/vuls/id/168699; http://www.securityfocus.com/bid/96616
CVE: CVE-2017-3188
Published: 2018-07-24
Description: The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/96616; https://www.kb.cert.org/vuls/id/168699; https://doc.dotcms.com/security/SI-41
CVE: CVE-2017-3189
Published: 2018-07-24
Description: The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle contains. This vulnerability combined with the path traversal vulnerability (CVE-2017-3188) can lead to remote command execution with the permissions of the user running the dotCMS application. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user or execute arbitrary system commands with the permissions of the user running the dotCMS application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/96616; https://www.kb.cert.org/vuls/id/168699; http://www.securityfocus.com/bid/96616
CVE: CVE-2017-3209
Published: 2018-07-24
Description: The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.
CVSS Score: 8.1 (HIGH)
CWE: CWE-276, CWE-276, CWE-306
References: https://dl.acm.org/citation.cfm?id=3139943; https://www.kb.cert.org/vuls/id/334207; https://www.securityfocus.com/bid/97564
CVE: CVE-2017-3210
Published: 2018-07-24
Description: Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution. A number of applications developed using the Portrait Displays SDK do not use secure permissions when running. These applications run the component pdiservice.exe with NT AUTHORITY/SYSTEM permissions. This component is also read/writable by all Authenticated Users. This allows local authenticated attackers to run arbitrary code with SYSTEM privileges. The following applications have been identified by Portrait Displays as affected: Fujitsu DisplayView Click: Version 6.0 and 6.01. The issue was fixed in Version 6.3. Fujitsu DisplayView Click Suite: Version 5. The issue is addressed by patch in Version 5.9. HP Display Assistant: Version 2.1. The issue was fixed in Version 2.11. HP My Display: Version 2.0. The issue was fixed in Version 2.1. Philips Smart Control Premium: Versions 2.23, 2.25. The issue was fixed in Version 2.26.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-16
References: https://www.kb.cert.org/vuls/id/219739; https://www.securityfocus.com/bid/98006; https://www.kb.cert.org/vuls/id/219739
CVE: CVE-2017-3217
Published: 2018-07-24
Description: CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured for this interface by the integrator / reseller. This interface must be password protected, otherwise, the attacker only needs to know the phone number of the device (via an IMSI Catcher, for example) to send administrative commands to the device. These commands can be used to provide ongoing, real-time access to the device and can configure parameters such as IP addresses, firewall rules, and passwords.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.kb.cert.org/vuls/id/251927; https://www.securityfocus.com/bid/98964; https://www.kb.cert.org/vuls/id/251927
CVE: CVE-2017-3223
Published: 2018-07-24
Description: Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be vulnerable to a stack buffer overflow. Dahua IP camera products include an application known as Sonia (/usr/bin/sonia) that provides the web interface and other services for controlling the IP camera remotely. Versions of Sonia included in firmware versions prior to DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621 do not validate input data length for the 'password' field of the web interface. A remote, unauthenticated attacker may submit a crafted POST request to the IP camera's Sonia web interface that may lead to out-of-bounds memory operations and loss of availability or remote code execution. The issue was originally identified by the researcher in firmware version DH_IPC-HX1X2X-Themis_EngSpnFrn_N_V2.400.0000.30.R.20160803.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/99620; https://www.kb.cert.org/vuls/id/547255; http://www.securityfocus.com/bid/99620
CVE: CVE-2017-3224
Published: 2018-07-24
Description: Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).
CVSS Score: 8.2 (HIGH)
CWE: CWE-354, CWE-345
References: https://www.kb.cert.org/vuls/id/793496; https://www.kb.cert.org/vuls/id/793496
CVE: CVE-2017-3225
Published: 2018-07-24
Description: Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-329, CWE-310
References: http://www.securityfocus.com/bid/100675; https://www.kb.cert.org/vuls/id/166743; http://www.securityfocus.com/bid/100675
CVE: CVE-2017-3226
Published: 2018-07-24
Description: Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature using environment encryption (i.e., setting the configuration parameter CONFIG_ENV_AES=y) read environment variables from disk as the encrypted disk image is processed. An attacker with physical access to the device can manipulate the encrypted environment data to include a crafted two-byte sequence which triggers an error in environment variable parsing. This error condition is improperly handled by Das U-Boot, resulting in an immediate process termination with a debugging message.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-329, CWE-310
References: http://www.securityfocus.com/bid/100675; https://www.kb.cert.org/vuls/id/166743; http://www.securityfocus.com/bid/100675
CVE: CVE-2018-5384
Published: 2018-07-24
Description: Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/103544; https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3; https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
CVE: CVE-2018-5385
Published: 2018-07-24
Description: Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: http://www.securityfocus.com/bid/103544; https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3; https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
CVE: CVE-2018-5386
Published: 2018-07-24
Description: Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288, CWE-200
References: http://www.securityfocus.com/bid/103544; https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3; https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html
CVE: CVE-2018-5387
Published: 2018-07-24
Description: Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-347
References: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations; https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f[PII_REDACTED]ebcb609ac7c3f5b3; https://github.com/GoGentoOSS/SAMLBase/issues/3
CVE: CVE-2018-14582
Published: 2018-07-24
Description: index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/bagesoft/bagecms/issues/2; https://github.com/bagesoft/bagecms/issues/2
CVE: CVE-2018-14583
Published: 2018-07-24
Description: xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/maoGod/xyhcms/issues/1; https://github.com/maoGod/xyhcms/issues/1
CVE: CVE-2018-14584
Published: 2018-07-24
Description: An issue has been discovered in Bento4 1.5.1-624. AP4_AvccAtom::Create in Core/Ap4AvccAtom.cpp has a heap-based buffer over-read.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/298; https://github.com/axiomatic-systems/Bento4/issues/304; https://github.com/axiomatic-systems/Bento4/issues/298