deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31842
Published: 2024-08-20
Description: An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability could lead to complete account takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-41659
Published: 2024-08-20
Description: memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-942
References: https://github.com/usememos/memos/blob/v0.20.1/server/server.go#L163; https://github.com/usememos/memos/commit/8101a5e0b162044c16385bee4f12a4a653d050b9; https://securitylab.github.com/advisories/GHSL-2024-034_memos/
CVE: CVE-2024-41773
Published: 2024-08-20
Description: IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-708
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/350347; https://www.ibm.com/support/pages/node/7165963
CVE: CVE-2024-6337
Published: 2024-08-20
Description: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pull_request_write: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access token was not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14 and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8
CVE: CVE-2024-6800
Published: 2024-08-20
Description: An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347, CWE-347
References: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16; https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8
CVE: CVE-2024-7711
Published: 2024-08-20
Description: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14; https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8; https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3
CVE: CVE-2024-41657
Published: 2024-08-20
Description: Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-942, CWE-697
References: https://github.com/casdoor/casdoor/blob/v1.577.0/routers/cors_filter.go#L45; https://securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor/
CVE: CVE-2024-41658
Published: 2024-08-20
Description: Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform.  In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via wechat pay. When using wechat pay, a QR code with the wechat pay link is displayed on the payment page, hosted on the domain of casdoor. This page takes a query parameter from the url successUrl, and redirects the user to that url after a successful purchase. Because the user has no reason to think that the payment page contains sensitive information, they may share it with other or can be social engineered into sending it to others. An attacker can then craft the casdoor link with a special url and send it back to the user, and once payment has gone though an XSS attack occurs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/casdoor/casdoor/blob/v1.577.0/web/src/QrCodePage.js; https://securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor/
CVE: CVE-2024-42361
Published: 2024-08-20
Description: Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/manager/src/main/java/org/dromara/hertzbeat/manager/controller/MonitorsController.java#L202; https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L242; https://github.com/dromara/hertzbeat/blob/1f12ac9f2a1a3d86b1d476775e14174243b250a8/warehouse/src/main/java/org/dromara/hertzbeat/warehouse/store/HistoryTdEngineDataStorage.java#L295
CVE: CVE-2024-42362
Published: 2024-08-20
Description: Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/apache/hertzbeat/commit/79f5408e345e8e89da97be05f43e3204a950ddfb; https://github.com/apache/hertzbeat/commit/9dbbfb7812fc4440ba72bdee66799edd519d06bb; https://github.com/apache/hertzbeat/pull/1611
CVE: CVE-2024-42363
Published: 2024-08-20
Description: Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/controllers/kubernetes/role_verifications_controller.rb#L10; https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/controllers/kubernetes/role_verifications_controller.rb#L7; https://github.com/zendesk/samson/blob/107efb4a252425966aac5e77d0c3670f9b5d7229/plugins/kubernetes/app/models/kubernetes/role_config_file.rb#L80
CVE: CVE-2024-43396
Published: 2024-08-20
Description: Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/khoj-ai/khoj/commit/1c7a562880eeb[PII_REDACTED]d2cf6c5d1d1134812; https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626; https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h
CVE: CVE-2024-43403
Published: 2024-08-20
Description: Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with a ClusterRole called edit via ClusterRoleBinding. The "edit" ClusterRole is one of Kubernetes default-created ClusterRole, and it has the create/patch/udpate verbs of daemonset resources, create verb of serviceaccount/token resources, and impersonate verb of serviceaccounts resources. A malicious user can leverage access the worker node which has this component to make a cluster-level privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://github.com/kanisterio/kanister/blob/master/helm/kanister-operator/templates/rbac.yaml#L49; https://github.com/kanisterio/kanister/security/advisories/GHSA-h27c-6xm3-mcqp
CVE: CVE-2024-43861
Published: 2024-08-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net: usb: qmi_wwan: fix memory leak for not ip packets

Free the unused skb when not ip packets arrive.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/37c[PII_REDACTED][PII_REDACTED]ba9b813cdb9475a4; https://git.kernel.org/stable/c/3c90a69533b5bba73401ef884d033ea49ee99662; https://git.kernel.org/stable/c/7ab107544b777c3bd7feb9fe447367d8edd5b202
CVE: CVE-2024-22281
Published: 2024-08-20
Description: ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.

This issue affects Apache Helix Front (UI): all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny; http://www.openwall.com/lists/oss-security/2024/08/20/3
CVE: CVE-2024-43862
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex

The carrier_lock spinlock protects the carrier detection. While it is
held, framer_get_status() is called which in turn takes a mutex.
This is not correct and can lead to a deadlock.

A run with PROVE_LOCKING enabled detected the issue:
  [ BUG: Invalid wait context ]
  ...
  c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78
  other info that might help us debug this:
  context-{4:4}
  2 locks held by ifconfig/146:
  #0: c0926a38 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x12c/0x664
  #1: c2006a40 (&qmc_hdlc->carrier_lock){....}-{2:2}, at: qmc_hdlc_framer_set_carrier+0x30/0x98

Avoid the spinlock usage and convert carrier_lock to a mutex.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/c4d6a347ba7babdf9d90a0eb24048c266cae0532; https://git.kernel.org/stable/c/f223d2b4acb7a45a6e0581cb380e1af1a6dc7ab9
CVE: CVE-2024-43863
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix a deadlock in dma buf fence polling

Introduce a version of the fence ops that on release doesn't remove
the fence from the pending list, and thus doesn't require a lock to
fix poll->fence wait->fence unref deadlocks.

vmwgfx overwrites the wait callback to iterate over the list of all
fences and update their status, to do that it holds a lock to prevent
the list modifcations from other threads. The fence destroy callback
both deletes the fence and removes it from the list of pending
fences, for which it holds a lock.

dma buf polling cb unrefs a fence after it's been signaled: so the poll
calls the wait, which signals the fences, which are being destroyed.
The destruction tries to acquire the lock on the pending fences list
which it can never get because it's held by the wait from which it
was called.

Old bug, but not a lot of userspace apps were using dma-buf polling
interfaces. Fix those, in particular this fixes KDE stalls/deadlock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/3b933b16c996af8adb6bc1b5748a63dfb41a82bc; https://git.kernel.org/stable/c/9908dc0d2ef0e4aec8a242c098455729c0e2f017; https://git.kernel.org/stable/c/9e20d028d8d1deb1e7fed18f22ffc01669cf3237
CVE: CVE-2024-43864
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix CT entry update leaks of modify header context

The cited commit allocates a new modify header to replace the old
one when updating CT entry. But if failed to allocate a new one, eg.
exceed the max number firmware can support, modify header will be
an error pointer that will trigger a panic when deallocating it. And
the old modify header point is copied to old attr. When the old
attr is freed, the old modify header is lost.

Fix it by restoring the old attr to attr when failed to allocate a
new modify header context. So when the CT entry is freed, the right
modify header context will be freed. And the panic of accessing
error pointer is also fixed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/025f2b85a5e5a46df14ecf162c3c80a957a36d0b; https://git.kernel.org/stable/c/89064d09c56b44c668509bf793c410484f63f5ad; https://git.kernel.org/stable/c/daab2cc17b6b6ab158566bba037e9551fd432b59
CVE: CVE-2024-43865
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/fpu: Re-add exception handling in load_fpu_state()

With the recent rewrite of the fpu code exception handling for the
lfpc instruction within load_fpu_state() was erroneously removed.

Add it again to prevent that loading invalid floating point register
values cause an unhandled specification exception.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4734406c39238cbeafe66f0060084caa3247ff53; https://git.kernel.org/stable/c/494b14138201f07343e5488db6360c828fcc8cf6
CVE: CVE-2024-43866
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Always drain health in shutdown callback

There is no point in recovery during device shutdown. if health
work started need to wait for it to avoid races and NULL pointer
access.

Hence, drain health WQ on shutdown callback.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-476
References: https://git.kernel.org/stable/c/1b75da22ed1e6171e261bc[PII_REDACTED]553d5393; https://git.kernel.org/stable/c/5005e2e159b300c1b8c6820a1e13a62eb0127b9b; https://git.kernel.org/stable/c/6048dec754554a1303d632be6042d3feb3295285
CVE: CVE-2024-43867
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: prime: fix refcount underflow

Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and
hence the backing ttm_bo) leads to a refcount underflow.

Instead of calling nouveau_bo_ref() in the unwind path of
drm_gem_object_init(), clean things up manually.

(cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://git.kernel.org/stable/c/16998763c62bb465ebc409d0373b9cdcef1a61a6; https://git.kernel.org/stable/c/2a1b327d57a8ac080977633a18999f032d7e9e3f; https://git.kernel.org/stable/c/3bcb8bba72ce89667fa[PII_REDACTED]67c450c47ef
CVE: CVE-2024-43868
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv/purgatory: align riscv_kernel_entry

When alignment handling is delegated to the kernel, everything must be
word-aligned in purgatory, since the trap handler is then set to the
kexec one. Without the alignment, hitting the exception would
ultimately crash. On other occasions, the kernel's handler would take
care of exceptions.
This has been tested on a JH7110 SoC with oreboot and its SBI delegating
unaligned access exceptions and the kernel configured to handle them.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/10ffafb456f293976c42f700578ef740467cb569; https://git.kernel.org/stable/c/5d4aaf16a8255f7c71790e211724ba029609c5ff; https://git.kernel.org/stable/c/6e62dab357eea12db0fc62dea94c7a892888e6e8
CVE: CVE-2024-8022
Published: 2024-08-21
Description: A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing of the file /vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=[PII_REDACTED][PII_REDACTED]&user=A&message2user=Account%20updated. The manipulation of the argument Phone Number leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.275291; https://vuldb.com/?id.275291; https://vuldb.com/?submit.389913
CVE: CVE-2024-8023
Published: 2024-08-21
Description: A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/74dcbe81062718f314d81fb6ad5dc1e0; https://vuldb.com/?ctiid.275292; https://vuldb.com/?id.275292
CVE: CVE-2024-43869
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exec and file release

The perf pending task work is never waited upon the matching event
release. In the case of a child event, released via free_event()
directly, this can potentially result in a leaked event, such as in the
following scenario that doesn't even require a weak IRQ work
implementation to trigger:

schedule()
   prepare_task_switch()
=======> <NMI>
      perf_event_overflow()
         event->pending_sigtrap = ...
         irq_work_queue(&event->pending_irq)
<======= </NMI>
      perf_event_task_sched_out()
          event_sched_out()
              event->pending_sigtrap = 0;
              atomic_long_inc_not_zero(&event->refcount)
              task_work_add(&event->pending_task)
   finish_lock_switch()
=======> <IRQ>
   perf_pending_irq()
      //do nothing, rely on pending task work
<======= </IRQ>

begin_new_exec()
   perf_event_exit_task()
      perf_event_exit_event()
         // If is child event
         free_event()
            WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
            // event is leaked

Similar scenarios can also happen with perf_event_remove_on_exec() or
simply against concurrent perf_event_release().

Fix this with synchonizing against the possibly remaining pending task
work while freeing the event, just like is done with remaining pending
IRQ work. This means that the pending task callback neither need nor
should hold a reference to the event, preventing it from ever beeing
freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/104e258a004037bc7dba9f6085c71dad6af57ad4; https://git.kernel.org/stable/c/3a5465418f5fd970e86a86c7f4075be262682840; https://git.kernel.org/stable/c/9ad46f1fef421d43cdab3a7d1744b2f43b54dae0
CVE: CVE-2024-43870
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred
to the target task upon resume to userspace via task_work.

However failures while adding an event's callback to the task_work
engine are ignored. And since the last call for events exit happen
after task work is eventually closed, there is a small window during
which pending sigtrap can be queued though ignored, leaking the event
refcount addition such as in the following scenario:

    TASK A
    -----

    do_exit()
       exit_task_work(tsk);

       <IRQ>
       perf_event_overflow()
          event->pending_sigtrap = pending_id;
          irq_work_queue(&event->pending_irq);
       </IRQ>
    =========> PREEMPTION: TASK A -> TASK B
       event_sched_out()
          event->pending_sigtrap = 0;
          atomic_long_inc_not_zero(&event->refcount)
          // FAILS: task work has exited
          task_work_add(&event->pending_task)
       [...]
       <IRQ WORK>
       perf_pending_irq()
          // early return: event->oncpu = -1
       </IRQ WORK>
       [...]
    =========> TASK B -> TASK A
       perf_event_exit_task(tsk)
          perf_event_exit_event()
             free_event()
                WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
                // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate task_work_add()'s error handling.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51; https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b; https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a
CVE: CVE-2024-43871
Published: 2024-08-21
Description: In the Linux kernel, the following vulnerability has been resolved:

devres: Fix memory leakage caused by driver API devm_free_percpu()

It will cause memory leakage when use driver API devm_free_percpu()
to free memory allocated by devm_alloc_percpu(), fixed by using
devres_release() instead of devres_destroy() within devm_free_percpu().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3047f99caec240a88ccd06197af2868da1af6a96; https://git.kernel.org/stable/c/3dcd0673e47664bc6c719ad47dadac6d55d5950d; https://git.kernel.org/stable/c/700e8abd65b10792b2f179ce4e858f2ca2880f85