deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-20545
Published: 2021-03-30
Description: Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://note.youdao.com/noteshare?id=29f908204968a79233c1c0c80a59f8ff&sub=AFA8E81AA31C[PII_REDACTED]C5DFE07033; http://note.youdao.com/noteshare?id=51d8946722c0304b5bfd72da03eaf013&sub=BDBAD6EDD2C941C18AB57141313AB5FE; http://note.youdao.com/noteshare?id=29f908204968a79233c1c0c80a59f8ff&sub=AFA8E81AA31C[PII_REDACTED]C5DFE07033
CVE: CVE-2021-29376
Published: 2021-03-30
Description: ircII before 20210314 allows remote attackers to cause a denial of service (segmentation fault and client crash, disconnecting the victim from an IRC server) via a crafted CTCP UTC message.
CVSS Score: 7.5 (HIGH)
References: http://www.eterna.com.au/ircii/; http://www.openwall.com/lists/oss-security/2021/03/30/4; https://lists.debian.org/debian-lts-announce/2021/08/msg00022.html
CVE: CVE-2021-29418
Published: 2021-03-30
Description: The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://vuln.ryotak.me/advisories/6
CVE: CVE-2021-26919
Published: 2021-03-30
Description: Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
CVSS Score: 8.8 (HIGH)
References: https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E; https://lists.apache.org/thread.html/r470f8c92eb5df45f41b3ae609b6315b6c5ff51b3ceb2f09f00ca620f%40%3Cdev.druid.apache.org%3E; https://lists.apache.org/thread.html/r6bc[PII_REDACTED]6448f823d12c17fd1fd875251d97d60869f58709872%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2021-21628
Published: 2021-03-30
Description: Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2231; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21629
Published: 2021-03-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Build With Parameters Plugin 1.5 and earlier allows attackers to build a project with attacker-specified parameters.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2257; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21630
Published: 2021-03-30
Description: Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2222; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21631
Published: 2021-03-30
Description: Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2246; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21632
Published: 2021-03-30
Description: A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2250; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21633
Published: 2021-03-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2250; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21634
Published: 2021-03-30
Description: Jenkins Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2162; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21635
Published: 2021-03-30
Description: Jenkins REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2261; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21636
Published: 2021-03-30
Description: A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%281%29; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21637
Published: 2021-03-30
Description: A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-21638
Published: 2021-03-30
Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2021/03/30/1; https://www.jenkins.io/security/advisory/2021-03-30/#SECURITY-2283%20%282%29; http://www.openwall.com/lists/oss-security/2021/03/30/1
CVE: CVE-2021-28935
Published: 2021-03-30
Description: CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12432; http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html; http://dev.cmsmadesimple.org/bug/view/12432
CVE: CVE-2021-29343
Published: 2021-03-30
Description: Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. The "checkbox" property into "text" data can be extracted and displayed in the text region or in source code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://ovidentia.org; https://www.exploit-db.com/exploits/49707; http://ovidentia.org
CVE: CVE-2020-15075
Published: 2021-03-30
Description: OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp.
CVSS Score: 7.1 (HIGH)
CWE: CWE-61, CWE-59
References: https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/; https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/
CVE: CVE-2021-26810
Published: 2021-03-30
Description: D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dir_setWanWifi, which can lead to command injection via shell metacharacters in the statuscheckpppoeuser parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/GD008/vuln/blob/main/DIR-816.md; https://www.dlink.com/en/security-bulletin/; https://github.com/GD008/vuln/blob/main/DIR-816.md
CVE: CVE-2021-21409
Published: 2021-03-30
Description: Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-444, CWE-444
References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295; https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432; https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32
CVE: CVE-2021-23363
Published: 2021-03-30
Description: This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/GuyMograbi/kill-by-port/blob/16dcbe264b6b4a5ecf409661b42836dd286fd43f/index.js%23L8; https://github.com/GuyMograbi/kill-by-port/commit/ea5b1f377e196a4492e05ff070eba8b30b7372c4; https://snyk.io/vuln/SNYK-JS-KILLBYPORT-1078531
CVE: CVE-2021-27261
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12269.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-343/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27262
Published: 2021-03-30
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12270.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-344/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27263
Published: 2021-03-30
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12290.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-345/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27264
Published: 2021-03-30
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12291.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-346/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27265
Published: 2021-03-30
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12292.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-347/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27266
Published: 2021-03-30
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-12293.
CVSS Score: 3.3 (LOW)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-348/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27267
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12294.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-349/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27268
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12295.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-350/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27269
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process Was ZDI-CAN-12390.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-351/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27270
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12230.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-352/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2021-27271
Published: 2021-03-30
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.0.37527. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in an out-of-bounds read condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12438.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.zerodayinitiative.com/advisories/ZDI-21-353/; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-4848
Published: 2021-03-30
Description: IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resources that they should not have access to. IBM X-Force ID: 190293.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190293; https://www.ibm.com/support/pages/node/6437573; https://exchange.xforce.ibmcloud.com/vulnerabilities/190293
CVE: CVE-2020-4884
Published: 2021-03-30
Description: IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 190908.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/190908; https://www.ibm.com/support/pages/node/6437565; https://exchange.xforce.ibmcloud.com/vulnerabilities/190908
CVE: CVE-2020-4944
Published: 2021-03-30
Description: IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain text after a manual edit, which can be read by a local user. IBM X-Force ID: 191944.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/191944; https://www.ibm.com/support/pages/node/6437567; https://exchange.xforce.ibmcloud.com/vulnerabilities/191944
CVE: CVE-2021-20482
Published: 2021-03-30
Description: IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197504.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/197504; https://www.ibm.com/support/pages/node/6437577; https://exchange.xforce.ibmcloud.com/vulnerabilities/197504
CVE: CVE-2021-21398
Published: 2021-03-30
Description: PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.7.3, an attacker can inject HTML when the Grid Column Type DataColumn is badly used. The problem is fixed in 1.7.7.3
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205; https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77