hitoshura25/cvefixes huggingface dataset:
CVE-2019-6128 (C, published 2019-01-11T05:29Z)
Description: value: The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://gitlab.com/libtiff/libtiff
Files changed:
tools/pal2rgb.c
Commit message: Fix for simple memory leak that was assigned CVE-2019-6128.

pal2rgb failed to free memory on a few errors. This was reported
here: http://bugzilla.maptools.org/show_bug.cgi?id=2836.


Vulnerable code:
	if (out == NULL)

Fixed code:
		(void) TIFFClose(in);
		(void) TIFFClose(in);
		(void) TIFFClose(in);
	if (out == NULL) {
		(void) TIFFClose(in);
	}
CVE-2019-7663 (C, published 2019-02-09T16:29Z)
Description: value: An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://gitlab.com/libtiff/libtiff
Files changed:
libtiff/tif_dirwrite.c
Commit message: TIFFWriteDirectoryTagTransferfunction() : fix NULL dereferencing

http://bugzilla.maptools.org/show_bug.cgi?id=2833

we must check the pointer is not NULL before memcmp() the memory


Vulnerable code:
		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
		if (!_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))

Fixed code:
		if (tif->tif_dir.td_transferfunction[2] == NULL ||
		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[2],m*sizeof(uint16)))
		if (tif->tif_dir.td_transferfunction[1] == NULL ||
		    !_TIFFmemcmp(tif->tif_dir.td_transferfunction[0],tif->tif_dir.td_transferfunction[1],m*sizeof(uint16)))
CVE-2024-1433 (C++, published 2024-02-11T23:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. The manipulation of the argument pluginId leads to path traversal. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-253407. NOTE: This requires write access to user's home or the installation of third party global themes.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/KDE/plasma-workspace
Files changed:
components/calendar/eventpluginsmanager.cpp
Commit message: plasmacalendarintegration: Fix directory traversal vulnerability in events plugins

digital-calendar plasma applet is vulnerable to directory traversal attack which allows an arbitrary .so library file to be leaded as a plasma calendar plugin.

This vulnerability can be triggered via theme files that provide a config for the digital-clock applet which includes `enabledCalendarPlugins` that uses directory traversal to load arbitrary .so from the filesystem.

This requires write access to user's home or the installation of third party global themes so is not directly exploitable by anything which did not have access already, however it should be fixed regardless.


Vulnerable code:
    QPluginLoader loader("plasmacalendarplugins/" + pluginId);

Fixed code:
    QPluginLoader loader("plasmacalendarplugins/" + QDir::cleanPath(pluginId));
CVE-2022-4890 (Ruby, published 2023-01-16T13:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/abhilash1985/PredictApp
Files changed:
config/initializers/new_framework_defaults_7_0.rb
Commit message: fixed security vulnerability


Vulnerable code:
Rails.application.config.action_dispatch.cookies_serializer = :hybrid

Fixed code:
Rails.application.config.action_dispatch.cookies_serializer = :json
CVE-2020-15086 (PHP, published 2020-07-29T17:15Z)
Description: value: In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/FriendsOfTYPO3/mediace
Files changed:
Resources/PHP/ValidateHashEID.php
Commit message: [SECURITY] Restrict file validation hash generation

Security-References: CVE-2020-15086


Vulnerable code:
    $addition = \TYPO3\CMS\Core\Utility\GeneralUtility::_GET('addition');
    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, $addition);

Fixed code:
    if (!is_string($value) || empty($value)) {
        \TYPO3\CMS\Core\Utility\HttpUtility::setResponseCodeAndExit(
            \TYPO3\CMS\Core\Utility\HttpUtility::HTTP_STATUS_400
        );
    }

    $content = \TYPO3\CMS\Core\Utility\GeneralUtility::hmac($value, 'flashvars');
CVE-2023-34102 (Ruby, published 2023-06-05T23:15Z)
Description: value: Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit `ec117882d` which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-470 \u2014 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Repository: https://github.com/avo-hq/avo
Files changed:
lib/avo/fields/belongs_to_field.rb
Commit message: Merge pull request from GHSA-86h2-2g4g-29qx

* fix vuln

* wip

Vulnerable code:
          model.send("#{polymorphic_as}_type=", params["#{polymorphic_as}_type"])
          if params["#{polymorphic_as}_type"].blank?

Fixed code:
        valid_model_class = valid_polymorphic_class params["#{polymorphic_as}_type"]

          model.send("#{polymorphic_as}_type=", valid_model_class)
          if valid_model_class.blank?
      def valid_polymorphic_class(possible_class)
        types.find do |type|
          type.to_s == possible_class.to_s
        end
      end
CVE-2023-34103 (Ruby, published 2023-06-05T23:15Z)
Description: value: Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting (XSS) when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are stored and no specific timing is required. This issue has been addressed in commit `7891c01e` which is expected to be included in the next release of avo. Users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/avo-hq/avo
Files changed:
app/components/avo/alert_component.html.erb
app/components/avo/field_wrapper_component.html.erb
app/components/avo/fields/common/heading_component.html.erb
app/components/avo/fields/trix_field/edit_component.html.erb
app/components/avo/fields/trix_field/show_component.html.erb
app/components/avo/index/field_wrapper_component.html.erb
Commit message: Merge pull request from GHSA-5cr9-5jx3-2g39



Vulnerable code:
          <%== message %>
          <div class="text-gray-600 mt-2 text-sm"><%== help %></div>
    <!-- <%== field.value.inspect %> -->
        <%== value %>
      <%== @field.value %>
      <%== @field.value %>
    <!-- <%== @field.value.inspect %> -->

Fixed code:
          <%= sanitize message %>
          <div class="text-gray-600 mt-2 text-sm"><%= sanitize help %></div>
    <!-- <%= sanitize field.value.inspect %> -->
        <%= sanitize value %>
      <%= sanitize @field.value %>
      <%= sanitize @field.value %>
    <!-- <%= sanitize @field.value.inspect %> -->
CVE-2024-22191 (JSON, published 2024-01-16T22:15Z)
Description: value: Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting (XSS) vulnerability was found in the key_value field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code. This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites. Avo 3.2.4 and 2.47.0 include a fix for this issue. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/avo-hq/avo
Files changed:
app/javascript/js/controllers/fields/key_value_controller.js
package.json
yarn.lock
Commit message: security: sanitize key_value field content (#2357)



Vulnerable code:
      result += this.interpolatedRow(key, value, index)

Fixed code:
import * as DOMPurify from 'dompurify'
      result += this.interpolatedRow(DOMPurify.sanitize(key), DOMPurify.sanitize(value), index)
    "dompurify": "^3.0.8",
dompurify@^3.0.8:
  version "3.0.8"
  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.0.8.tgz#e0021ab1b09184bc8af7e35c7dd9063f43a8a437"
  integrity sha512-b7uwreMYL2eZhrSCRC4ahLTeZcPZxSmYfmcQGXGkXiZSNW1X85v+SDM5KsWcpivIiUBH47Ji7NtyUdpLeF5JZQ==
CVE-2024-22411 (JSON, published 2024-01-16T22:15Z)
Description: value: Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/avo-hq/avo
Files changed:
app/javascript/js/controllers/fields/key_value_controller.js
package.json
yarn.lock
Commit message: security: sanitize key_value field content (#2357)



Vulnerable code:
      result += this.interpolatedRow(key, value, index)

Fixed code:
import * as DOMPurify from 'dompurify'
      result += this.interpolatedRow(DOMPurify.sanitize(key), DOMPurify.sanitize(value), index)
    "dompurify": "^3.0.8",
dompurify@^3.0.8:
  version "3.0.8"
  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.0.8.tgz#e0021ab1b09184bc8af7e35c7dd9063f43a8a437"
  integrity sha512-b7uwreMYL2eZhrSCRC4ahLTeZcPZxSmYfmcQGXGkXiZSNW1X85v+SDM5KsWcpivIiUBH47Ji7NtyUdpLeF5JZQ==
CVE-2015-7510 (C, published 2017-09-25T21:29Z)
Description: value: Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/keszybz/systemd
Files changed:
src/nss-mymachines/nss-mymachines.c
Commit message: nss-mymachines: do not allow overlong machine names

https://github.com/systemd/systemd/issues/2002


Vulnerable code:

Fixed code:
        if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
                goto not_found;

        if (e - p > HOST_NAME_MAX - 1)  /* -1 for the last dash */
                goto not_found;
CVE-2024-30264 (Other, published 2024-04-04T21:15Z)
Description: value: Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the `redirectPath` parameter from the URL. If a user clicks on a link where the `redirectPath` parameter has a javascript scheme, the attacker that crafted the link may be able to execute arbitrary JavaScript with the privileges  of the user. Version 2.24.0 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/baptisteArno/typebot.io
Files changed:
apps/builder/package.json
apps/builder/src/features/auth/components/SignInForm.tsx
pnpm-lock.yaml
Commit message: 🔒 Use sanitizeUrl on redirectPath auth param (#1389)



Vulnerable code:
      router.replace(router.query.redirectPath?.toString() ?? '/typebots')

Fixed code:
    "@braintree/sanitize-url": "7.0.1",
import { sanitizeUrl } from '@braintree/sanitize-url'

      const redirectPath = router.query.redirectPath?.toString()
      router.replace(redirectPath ? sanitizeUrl(redirectPath) : '/typebots')
      '@braintree/sanitize-url':
        specifier: 7.0.1
        version: 7.0.1
  /@braintree/sanitize-url@7.0.1:
    resolution: {integrity: sha512-URg8UM6lfC9ZYqFipItRSxYJdgpU5d2Z4KnjsJ+rj6tgAmGme7E+PQNCiud8g0HDaZKMovu2qjfa0f5Ge0Vlsg==}
    dev: false
CVE-2014-125028 (Python, published 2022-12-31T20:15Z)
Description: value: A vulnerability was found in valtech IDP Test Client and classified as problematic. Affected by this issue is some unknown functionality of the file python-flask/main.py. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The name of the patch is f1e7b3d431c8681ec46445557125890c14fa295f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217148.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/valtech/valtech-idp-test-clients
Files changed:
python-flask/main.py
Commit message: Add CSRF protection using state to python-flask


Vulnerable code:
from flask import Flask, render_template, request, session, redirect
  authorize_url = 'https://stage-id.valtech.com/oauth2/authorize?response_type=%s&client_id=%s&scope=%s' % ('code', CLIENT_ID, 'email openid')
  return redirect(authorize_url)
  
  return redirect('/')

Fixed code:
from flask import Flask, render_template, request, session, redirect, make_response
import uuid

  # state is used for CSRF protection. the client generates a value and stores it
  # for the user somewhere (in a cookie or in a session). it then passes the same value
  # in the state parameter in the authorize request. IDP will mirror the state value
  # to the redirect URI. the client should then make sure the state value it has stored
  # matches what it receives in the callback
  state = str(uuid.uuid4())

  authorize_url = 'https://stage-id.valtech.com/oauth2/authorize?response_type=%s&client_id=%s&scope=%s&state=%s' % ('code', CLIENT_ID, 'email openid', state)

  resp = make_response(redirect(authorize_url))
  resp.set_cookie('python-flask-csrf', state)
  return resp
  state = request.args.get('state')

  if state != request.cookies.get('python-flask-csrf'):
    raise Exception("Possible CSRF detected (state does not match stored state)")

  resp = make_response(redirect('/'))
  resp.set_cookie('python-flask-csrf', '', expires=0)
  return resp
CVE-2022-25926 (JSON, published 2023-01-04T18:15Z)
Description: value: Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/bruno-robert/window-control
Files changed:
index.js
package-lock.json
package.json
Commit message: fix: add sanitisation to user input


Vulnerable code:
      exec(`osascript "${macFocusAndSendKeys}" ${id} "${keys}" ${resetFocus} ${pressEnterOnceDone}`, (error, stdout, stderr) => {
      exec(`${winSendKeysToWindowName} "${windowTitle}" "${keys}"`, (error, stdout, stderr) => {
      exec(`${sendTextToWindowWithId} ${windowID} "${keys}"`, (error, stdout, stderr) => {
}
  "version": "1.4.4",
  "lockfileVersion": 1,
  "version": "1.4.4",

Fixed code:
const sanitiseUserInput = (input) => {
  let newInput = (' ' + input).slice(1)
  newInput = newInput.replaceAll("'", "");
  return newInput
}

      exec(`osascript "${macFocusAndSendKeys}" '${sanitiseUserInput(id)}' '${sanitiseUserInput(keys)}' ${resetFocus} ${pressEnterOnceDone}`, (error, stdout, stderr) => {
      exec(`${winSendKeysToWindowName} '${sanitiseUserInput(windowTitle)}' '${sanitiseUserInput(keys)}'`, (error, stdout, stderr) => {
      exec(`${sendTextToWindowWithId} '${sanitiseUserInput(windowID)}' '${sanitiseUserInput(keys)}'`, (error, stdout, stderr) => {
}
  "version": "1.4.5",
  "lockfileVersion": 2,
  "packages": {
    "": {
      "name": "window-control",
      "version": "1.4.5",
      "license": "MIT",
      "dependencies": {
        "hazardous": "^0.3.0",
        "json5": "^2.1.1"
      }
    },
    "node_modules/callsite": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz",
      "integrity": "sha1-KAOY5dZkvXQDi28JBRU+borxvCA=",
      "engines": {
        "node": "*"
      }
    },
    "node_modules/hazardous": {
      "version": "0.3.0",
      "resolved": "https://registry.npmjs.org/hazardous/-/hazardous-0.3.0.tgz",
      "integrity": "sha512-VLSlBMoLTnfScKBJTycufZ2OHLO06eS3Q0mxNdHJ+egd1QLqeLitxDeGeUuoIgOqSPer+uqZCxiv43a1EVmwdg==",
      "dependencies": {
        "callsite": "^1.0.0"
      }
    },
    "node_modules/json5": {
      "version": "2.1.1",
      "resolved": "https://registry.npmjs.org/json5/-/json5-2.1.1.tgz",
      "integrity": "sha512-l+3HXD0GEI3huGq1njuqtzYK8OYJyXMkOLtQ53pjWh89tvWS2h6l+1zMkYWqlb57+SiQodKZyvMEFb2X+KrFhQ==",
      "dependencies": {
        "minimist": "^1.2.0"
      },
      "bin": {
        "json5": "lib/cli.js"
      },
      "engines": {
        "node": ">=6"
      }
    },
    "node_modules/minimist": {
      "version": "1.2.6",
      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
    }
  },
  "version": "1.4.5",
CVE-2016-3728 (Ruby, published 2016-05-20T14:59Z)
Description: value: Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/theforeman/smart-proxy
Files changed:
modules/tftp/tftp_api.rb
test/tftp/tftp_api_test.rb
Commit message: Fixes #14931 - TFTP class instantiating fixed


Vulnerable code:
        log_halt 403, "Unrecognized pxeboot config type: #{variant}" unless defined? variant.capitalize
        eval "Proxy::TFTP::#{variant.capitalize}.new"

Fixed code:
    VARIANTS = ["Syslinux", "Pxegrub", "Pxegrub2", "Ztp", "Poap"].freeze
        log_halt 403, "Unrecognized pxeboot config type: #{variant}" unless VARIANTS.include?(variant.capitalize)
        Object.const_get("Proxy").const_get('TFTP').const_get(variant.capitalize).new
  def test_instantiate_syslinux
    obj = app.helpers.instantiate "syslinux", "AA:BB:CC:DD:EE:FF"
    assert_equal "Proxy::TFTP::Syslinux", obj.class.name
  end

  def test_instantiate_nonexisting
    subject = app
    subject.helpers.expects(:log_halt).with(403, "Unrecognized pxeboot config type: Server").at_least(1)
    subject.helpers.instantiate "Server", "AA:BB:CC:DD:EE:FF"
  end