deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7894
Published: 2024-12-07
Description: The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/if-menu/trunk/src/Admin.php#L16; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3203054%40if-menu&new=3203054%40if-menu&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ff6ebf45-4617-44dd-94d8-28aa8bc1609b?source=cve
CVE: CVE-2024-8679
Published: 2024-12-07
Description: The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owt_lib_handler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/library-management-system/trunk/admin/class-library-management-system-admin.php#L2092; https://plugins.trac.wordpress.org/changeset/3382258; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee792903-3b55-4f1d-bba1-59ea3f1826a1?source=cve
CVE: CVE-2024-11183
Published: 2024-12-07
Description: The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ff3f2788-d1a1-4a62-a247-39a931308f51/
CVE: CVE-2024-53143
Published: 2024-12-07
Description: In the Linux kernel, the following vulnerability has been resolved:

fsnotify: Fix ordering of iput() and watched_objects decrement

Ensure the superblock is kept alive until we're done with iput().
Holding a reference to an inode is not allowed unless we ensure the
superblock stays alive, which fsnotify does by keeping the
watched_objects count elevated, so iput() must happen before the
watched_objects decrement.
This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the
UAF is hard to hit because race orderings that oops are more likely, thanks
to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super().

Also, ensure that fsnotify_put_sb_watched_objects() doesn't call
fsnotify_sb_watched_objects() on a superblock that may have already been
freed, which would cause a UAF read of sb->s_fsnotify_info.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/21d1b618b6b9da46c5116c640ac4b1cc8d40d63a; https://git.kernel.org/stable/c/45a8f8232a495221ed058191629f5c628f21601a; https://git.kernel.org/stable/c/83af1cfa10d9aafdabd06b3655e07727f373b434
CVE: CVE-2024-11010
Published: 2024-12-07
Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'default_lang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server, allowing the execution of any JavaScript code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/init.php#L222; https://plugins.trac.wordpress.org/browser/fileorganizer/trunk/main/fileorganizer.php#L149; https://plugins.trac.wordpress.org/changeset/3201635/
CVE: CVE-2024-11367
Published: 2024-12-07
Description: The Smoove connector for Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smoove-elementor/tags/3.0.3/inc/modules/api-logs-table.php#L134; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206822%40smoove-elementor&new=3206822%40smoove-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8129bc3a-41c9-4a1e-8e04-55e23bb8d46d?source=cve
CVE: CVE-2024-11374
Published: 2024-12-07
Description: The TWChat – Send or receive messages from users plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/twchat/tags/4.0.3/classes/Addon_controller.class.php#L198; https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb047d0-0056-432c-bae3-3ab926e39bcd?source=cve
CVE: CVE-2024-12128
Published: 2024-12-07
Description: The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘monthly_sales_current_year’ parameter in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/simple-e-commerce-shopping-cart/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c7d688af-649c-4858-9c63-b12933d78bc2?source=cve
CVE: CVE-2024-12253
Published: 2024-12-07
Description: The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'save_settings', 'export_csv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the plugins settings and retrieve order and log data (which is also accessible to unauthenticated users).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/simple-e-commerce-shopping-cart/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6a1956-73aa-4ac3-ae1c-ef5f62bad718?source=cve
CVE: CVE-2024-12270
Published: 2024-12-07
Description: The Beautiful taxonomy filters plugin for WordPress is vulnerable to SQL Injection via the 'selects[0][term]' parameter in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/beautiful-taxonomy-filters/trunk/includes/class-beautiful-taxonomy-filters.php; https://plugins.trac.wordpress.org/changeset/3205710/; https://www.wordfence.com/threat-intel/vulnerabilities/id/75c9c106-d1f9-43ee-be1f-3eddec8f2529?source=cve
CVE: CVE-2024-11380
Published: 2024-12-07
Description: The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-mini-program/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b9499b-3017-46a6-80d5-104d203b77f0?source=cve
CVE: CVE-2024-11457
Published: 2024-12-07
Description: The Feedpress Generator – External RSS Frontend Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/feedpress-generator/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f9660aee-1069-4197-b166-12ea30f8fd0c?source=cve
CVE: CVE-2024-11464
Published: 2024-12-07
Description: The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/easy-code-snippets/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/31f5ddbf-2014-40e7-881d-27148bf133ff?source=cve
CVE: CVE-2024-11501
Published: 2024-12-07
Description: The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wd_gallery_$id parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/multi-gallery/tags/1.3/partials/Shortcode.php#L21; https://www.wordfence.com/threat-intel/vulnerabilities/id/778f7d9b-6376-4026-a291-1fedeabe8c99?source=cve
CVE: CVE-2024-37071
Published: 2024-12-07
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://www.ibm.com/support/pages/node/7175940
CVE: CVE-2024-47115
Published: 2024-12-07
Description: IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7178033
CVE: CVE-2024-41762
Published: 2024-12-07
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://www.ibm.com/support/pages/node/7175946
CVE: CVE-2024-47107
Published: 2024-12-07
Description: IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7178104
CVE: CVE-2024-53473
Published: 2024-12-07
Description: WeGIA 3.2.0 before 3998672 does not verify permission to change a password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/nilsonLazarin/WeGIA/commit/3998672f1b86db58eab2808a640903d73b37bd2d; https://github.com/nilsonLazarin/WeGIA/issues/791; https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-53473/README.md
CVE: CVE-2024-12209
Published: 2024-12-08
Description: The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/wp-health/tags/v2.16.4/src/Actions/RestoreRouter.php#L45; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202883%40wp-health&new=3202883%40wp-health&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c74ce3e8-cab9-4cc6-a1ad-1e51f7268474?source=cve
CVE: CVE-2024-12342
Published: 2024-12-08
Description: A vulnerability was found in TP-Link VN020 F3v(T) TT_V6.2.1021. It has been rated as critical. This issue affects some unknown processing of the file /control/WANIPConnection of the component Incomplete SOAP Request Handler. The manipulation leads to denial of service. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/Zephkek/TP-WANPunch/blob/main/README.md; https://vuldb.com/?ctiid.287261; https://vuldb.com/?id.287261
CVE: CVE-2024-12343
Published: 2024-12-08
Description: A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnection of the component SOAP Request Handler. The manipulation of the argument NewConnectionType leads to buffer overflow. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/Zephkek/TP-WANPunch/blob/main/README.md; https://vuldb.com/?ctiid.287262; https://vuldb.com/?id.287262
CVE: CVE-2024-12344
Published: 2024-12-08
Description: A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Command Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://github.com/Zephkek/TP-1450; https://vuldb.com/?ctiid.287265; https://vuldb.com/?id.287265
CVE: CVE-2024-55560
Published: 2024-12-08
Description: MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/MailCleaner/MailCleaner/commit/28d913eaa044b689eb114f72ebe92d48cb4aaca7; https://github.com/MailCleaner/MailCleaner/wiki/Watchdogs#host_keys; https://www.mailcleaner.net/infobox/mc-info-box.php
CVE: CVE-2024-12346
Published: 2024-12-09
Description: A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_cv_manager. The manipulation of the argument redirect_url leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The provided PoC only works in Mozilla Firefox. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://cloudphoto.ro/en/OVcHC1Pb3twmFC7; https://vuldb.com/?ctiid.287266; https://vuldb.com/?id.287266
CVE: CVE-2024-12347
Published: 2024-12-09
Description: A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Druid%20monitoring%20interface%20is%20not%20authorized.docx; https://vuldb.com/?ctiid.287267; https://vuldb.com/?id.287267
CVE: CVE-2024-12348
Published: 2024-12-09
Description: A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/dycccccccc/jpress/blob/main/JPRESS%20has%20XSS%20vulnerability.docx; https://vuldb.com/?ctiid.287268; https://vuldb.com/?id.287268
CVE: CVE-2024-12349
Published: 2024-12-09
Description: A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Cross_Site_Request_Forgery/Cross-Site-Request-Forgery.md; https://vuldb.com/?ctiid.287269; https://vuldb.com/?id.287269
CVE: CVE-2024-12350
Published: 2024-12-09
Description: A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-94
References: https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Server_Side%20_Template_Injection/Server-Side-Template-Injection.md; https://vuldb.com/?ctiid.287270; https://vuldb.com/?id.287270
CVE: CVE-2024-12351
Published: 2024-12-09
Description: A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hadagaga/vuln/blob/master/JFinalCMS/sql-1/SQL_injection_vulnerability.md; https://vuldb.com/?ctiid.287271; https://vuldb.com/?id.287271
CVE: CVE-2024-55563
Published: 2024-12-09
Description: Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example, the outcome of an HTLC (Hashed Timelock Contract) can be changed because a flood of transaction traffic prevents propagation of certain Lightning channel transactions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://ariard.github.io; https://bitcoincore.org; https://delvingbitcoin.org/t/full-disclosure-transaction-relay-throughput-overflow-attacks-against-off-chain-protocols/1305
CVE: CVE-2024-12352
Published: 2024-12-09
Description: A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/zheng0064/cve/blob/main/StackOverFlow-CVE.md; https://vuldb.com/?ctiid.287272; https://vuldb.com/?id.287272
CVE: CVE-2024-12353
Published: 2024-12-09
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://github.com/jasontimwong/CVE/issues/1; https://vuldb.com/?ctiid.287273; https://vuldb.com/?id.287273
CVE: CVE-2024-12354
Published: 2024-12-09
Description: A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-787
References: https://github.com/jasontimwong/CVE/issues/2; https://vuldb.com/?ctiid.287274; https://vuldb.com/?id.287274
CVE: CVE-2024-12355
Published: 2024-12-09
Description: A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function ContactBook::adding of the file ContactBook.cpp. The manipulation leads to improper input validation. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://github.com/TinkAnet/cve/blob/main/BOF2.md; https://vuldb.com/?ctiid.287275; https://vuldb.com/?id.287275
CVE: CVE-2024-55564
Published: 2024-12-09
Description: The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://metacpan.org/dist/POSIX-2008/changes
CVE: CVE-2024-55565
Published: 2024-12-09
Description: nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-835
References: https://github.com/ai/nanoid/compare/3.3.7...3.3.8; https://github.com/ai/nanoid/pull/510; https://github.com/ai/nanoid/releases/tag/5.0.9