rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-3445 
Unspecified vulnerability in Code-Crafters Ability Mail Server before 2.70 allows remote attackers to cause a denial of service (daemon crash) via an IMAP4 FETCH command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-28T22:00:00.000Z
CVE-2009-3446 
SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) component 1.0 Beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a videos action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-28T22:00:00.000Z
CVE-2009-3447 
Unrestricted file upload vulnerability in RADactive I-Load before 2008.2.5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, and then sending a request for a predictable filename during a short time window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3448 
npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service (daemon crash) via a packet to (1) TCP or (2) UDP port 20031 with a large value in an unspecified size field, which is not properly handled in a malloc operation.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3449 
MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3450 
Multiple cross-site scripting (XSS) vulnerabilities in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allow remote attackers to inject arbitrary web script or HTML via parameters with names beginning with __ (underscore underscore) sequences, which are incompatible with an XSS protection mechanism provided by Microsoft ASP.NET.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3451 
Directory traversal vulnerability in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3452 
WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to obtain sensitive information via unspecified requests that trigger responses containing the saved-image folder pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T15:00:00.000Z
CVE-2009-3453 
Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1.0 services for WebSphere Portal allow remote attackers to inject arbitrary web script or HTML via the filename of a .odt file in a Lotus Quickr place, related to the Library template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-3455 
Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-3456 
Google Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-3457 
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-3458 
Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2998.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T22:00:00.000Z
CVE-2009-3459 
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-3460 
Adobe Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T22:00:00.000Z
CVE-2009-3461 
Unspecified vulnerability in Adobe Acrobat 9.x before 9.2 allows attackers to bypass intended file-extension restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T22:00:00.000Z
CVE-2009-3462 
Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 on Unix, when Debug mode is enabled, allow attackers to execute arbitrary code via unspecified vectors, related to a "format bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T22:00:00.000Z
CVE-2009-3463 
Array index error in Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3464 
Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site, related to an "invalid pointer vulnerability," a different issue than CVE-2009-3465.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3465 
Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site, related to an "invalid pointer vulnerability," a different issue than CVE-2009-3464.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3466 
Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption, related to an "invalid string length vulnerability." NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3467 
Cross-site scripting (XSS) vulnerability in an unspecified method in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-13T17:00:00.000Z
CVE-2009-3468 
Multiple unspecified vulnerabilities in Common Desktop Environment (CDE) in Sun Solaris 10, when Trusted Extensions is enabled, allow local users to execute arbitrary commands or bypass the Mandatory Access Control (MAC) policy via unknown vectors, related to a menu typo and the Style Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T19:00:00.000Z
CVE-2009-3469 
Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T19:00:00.000Z
CVE-2009-3470 
IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11, 11.10 before 11.10.xC4, and 11.50 before 11.50.xC5 allows remote attackers to cause a denial of service (memory corruption, assertion failure, and daemon crash) by sending a long password over a JDBC connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T21:00:00.000Z
CVE-2009-3471 
IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP2 does not perform the expected drops of certain table functions upon a loss of privileges by the functions' definers, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T21:00:00.000Z
CVE-2009-3472 
IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 allows remote authenticated users to bypass intended access restrictions, and update, insert, or delete table rows, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T21:00:00.000Z
CVE-2009-3473 
IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T21:00:00.000Z
CVE-2009-3474 
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T23:00:00.000Z
CVE-2009-3475 
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T23:00:00.000Z
CVE-2009-3476 
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T23:00:00.000Z
CVE-2009-3477 
The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T23:00:00.000Z
CVE-2009-3478 
Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP Extension 1.0.5 for Firefox allows remote authenticated SFTP users to cause victims to alter permissions, delete, download, or move the wrong file via a filename containing " (double quotes), which is not properly filtered or encoded when FireFTP constructs the command to send to psftp.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T23:00:00.000Z
CVE-2009-3479 
Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows remote attackers, with "create content displayed by the Bibliography module" permissions, to inject arbitrary web script or HTML via a title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3480 
SQL injection vulnerability in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! allows remote attackers to execute arbitrary SQL commands via the p3 parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3481 
A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which has unspecified impact and remote attack vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3482 
TrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGRAMFILES%, which allows local users to gain privileges by replacing executables with Trojan horse programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3483 
Heap-based buffer overflow in the Create New Site feature in GlobalSCAPE CuteFTP Professional, Home, and Lite 8.3.3 and 8.3.3.0054 allows user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a site list containing an entry with a long label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3484 
Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname in an FTP server entry in a site backup file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3485 
Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3486 
Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via the host parameter to (1) the pinghost program, reachable through the diagnose program; or (2) the traceroute program, reachable through the diagnose program; or (3) the probe-limit parameter to the configuration program; the (4) wizard-ids or (5) pager-new-identifier parameter in a firewall-filters action to the configuration program; (6) the cos-physical-interface-name parameter in a cos-physical-interfaces-edit action to the configuration program; the (7) wizard-args or (8) wizard-ids parameter in an snmp action to the configuration program; the (9) username or (10) fullname parameter in a users action to the configuration program; or the (11) certname or (12) certbody parameter in a local-cert (aka https) action to the configuration program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3487 
Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inject arbitrary web script or HTML via (1) the JEXEC_OUTID parameter in a JEXEC_MODE_RELAY_OUTPUT action to the jexec program; the (2) act, (3) refresh-time, or (4) ifid parameter to scripter.php; (5) the revision parameter in a rollback action to the configuration program; the m[] parameter to the (6) monitor, (7) manage, (8) events, (9) configuration, or (10) alarms program; (11) the m[] parameter to the default URI; (12) the m[] parameter in a browse action to the default URI; (13) the wizard-next parameter in an https action to the configuration program; or the (14) Contact Information, (15) System Description, (16) Local Engine ID, (17) System Location, or (18) System Name Override SNMP parameter, related to the configuration program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3488 
Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with certain content-creation privileges, to inject arbitrary web script or HTML via the Title field, probably a different vulnerability than CVE-2009-3479.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3489 
Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3490 
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3491 
SQL injection vulnerability in the Kinfusion SportFusion (com_sportfusion) component 0.2.2 through 0.2.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a teamdetail action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3492 
Multiple PHP remote file inclusion vulnerabilities in Loggix Project 9.4.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pathToIndex parameter to (1) Calendar.php, (2) Comment.php, (3) Rss.php and (4) Trackback.php in lib/Loggix/Module/; and (5) modules/downloads/lib/LM_Downloads.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3493 
Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) scrivi.php and (2) index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3494 
Multiple SQL injection vulnerabilities in index.php in T-HTB Manager 0.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a delete_category action, (2) the name parameter in an update_category action, and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3495 
SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the mag_id parameter, a different vector than CVE-2008-4465.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3496 
Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the mag_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3497 
SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3498 
SQL injection vulnerability in php/update_article_hits.php in HBcms 1.7 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3499 
SQL injection vulnerability in employee.aspx in BPowerHouse BPLawyerCaseDocuments 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3500 
Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to main.php and (2) game_id parameter to game.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3501 
SQL injection vulnerability in students.php in BPowerHouse BPStudents 1.0 allows remote attackers to execute arbitrary SQL commands via the test parameter in a preview action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3502 
SQL injection vulnerability in music.php in BPowerHouse BPMusic 1.0 allows remote attackers to execute arbitrary SQL commands via the music_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3503 
Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse BPHolidayLettings 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) rid and (2) tid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3504 
SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z
CVE-2009-3505 
SQL injection vulnerability in view_news.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the news_id parameter.  NOTE: the game_id vector is already covered by CVE-2008-4460.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-30T15:00:00.000Z