rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-1391 
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-19T10:00:00.000Z
CVE-2014-1398 
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-1399 
The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-1400 
The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-10T15:00:00.000Z
CVE-2014-1401 
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-11T17:00:00.000Z
CVE-2014-1402 
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2014-1403 
Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T15:00:00.000Z
CVE-2014-1405 
Multiple open redirect vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2014-1406 
CRLF injection vulnerability in goform/formWlSiteSurvey on the Conceptronic C54APM access point with runtime code 1.26 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the submit-url parameter in a Refresh action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2014-1407 
Multiple cross-site scripting (XSS) vulnerabilities on the Conceptronic C54APM access point with runtime code 1.26 allow remote attackers to inject arbitrary web script or HTML via (1) the submit-url parameter in a Refresh action to goform/formWlSiteSurvey or (2) the wlan-url parameter to goform/formWlanSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2014-1408 
The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via an HTTP request, as demonstrated by stored XSS attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-10T16:00:00.000Z
CVE-2014-1409 
MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T15:29:10.000Z
CVE-2014-1418 
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T15:00:00.000Z
CVE-2014-1419 
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-24T14:00:00.000Z
CVE-2014-1420 Insecure temp file usage in Ubuntu UI toolkit
On desktop, Ubuntu UI Toolkit's StateSaver would serialise data on tmp/ files which an attacker could use to expose potentially sensitive data. StateSaver would also open files without the O_EXCL flag. An attacker could exploit this to launch a symlink attack, though this is partially mitigated by symlink and hardlink restrictions in Ubuntu. Fixed in 1.1.1188+14.10.20140813.4-0ubuntu1.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Canonical
product: ubuntu-ui-toolkit
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Olivier Tilloy
Published: 2020-09-10T23:55:14.770Z
CVE-2014-1421 
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-25T15:00:00.000Z
CVE-2014-1422 Location service uses cached authorization even after revocation
In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: Canonical
product: trust-store (Ubuntu)
vendor: Canonical
product: trust-store (Ubuntu RTM)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: David Barth
Published: 2020-07-22T18:05:19.844Z
CVE-2014-1423 Online Accounts Signon daemon gives out all oauth tokens to any app
signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oauth tokens for other applications, exposing sensitive information.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Ubuntu
product: signon
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Michael Zanetti
Published: 2020-05-07T22:25:16.912Z
CVE-2014-1424 
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T15:00:00.000Z
CVE-2014-1425 
cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-07T19:00:00.000Z
CVE-2014-1426 get_file_by_name does not check owner
A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any file. This issue affects: Ubuntu MAAS versions prior to 1.9.2.
Problem types: description: Missing access controls.
Affected products: vendor: Ubuntu
product: maas
Published: 2019-04-22T15:35:58.973Z
CVE-2014-1427 MAAS API vulnerable to CSRF attack
A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2.
Problem types: description: Cross-site scripting
Affected products: vendor: Ubuntu
product: MAAS
Published: 2019-04-22T15:35:59.055Z
CVE-2014-1428 uuid.uuid1() is not suitable as an unguessable identifier/token
A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Problem types: description: Insufficient randomness in generated filenames.
Affected products: vendor: Ubuntu
product: MAAS
Published: 2019-04-22T15:35:59.093Z
CVE-2014-1438 
The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T22:00:00.000Z
CVE-2014-1439 
The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T19:00:00.000Z
CVE-2014-1441 
Core FTP Server 1.2 before build 515 allows remote attackers to cause a denial of service (reachable assertion and crash) via an AUTH SSL command with malformed data, as demonstrated by pressing the enter key twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T01:00:00.000Z
CVE-2014-1442 
Directory traversal vulnerability in Core FTP Server 1.2 before build 515 allows remote authenticated users to determine the existence of arbitrary files via a /../ sequence in an XCRC command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T01:00:00.000Z
CVE-2014-1443 
Core FTP Server 1.2 before build 515 allows remote authenticated users to obtain sensitive information (password for the previous user) via a USER command with a specific length, possibly related to an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-02T01:00:00.000Z
CVE-2014-1444 
The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T22:00:00.000Z
CVE-2014-1445 
The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T22:00:00.000Z
CVE-2014-1446 
The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-18T22:00:00.000Z
CVE-2014-1447 
Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2014-1449 
The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-25T21:00:00.000Z
CVE-2014-1452 
Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T15:00:00.000Z
CVE-2014-1453 
The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2014-1454 
Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-08T13:42:56.000Z
CVE-2014-1455 
SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-10T14:00:00.000Z
CVE-2014-1456 
Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-28T17:00:00.000Z
CVE-2014-1457 
Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-20T21:00:00.000Z
CVE-2014-1458 
Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T18:00:00.000Z
CVE-2014-1459 
SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-11T17:00:00.000Z
CVE-2014-1466 
SQL injection vulnerability in CSP MySQL User Manager 2.3 allows remote attackers to execute arbitrary SQL commands via the login field of the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-15T16:00:00.000Z
CVE-2014-1467 
BlackBerry Enterprise Service 10 before 10.2.1, Universal Device Service 6, Enterprise Server Express for Domino through 5.0.4, Enterprise Server Express for Exchange through 5.0.4, Enterprise Server for Domino through 5.0.4 MR6, Enterprise Server for Exchange through 5.0.4 MR6, and Enterprise Server for GroupWise through 5.0.4 MR6 log cleartext credentials during exception handling, which might allow context-dependent attackers to obtain sensitive information by reading a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-14T02:00:00.000Z
CVE-2014-1469 
BlackBerry Enterprise Server 5.x before 5.0.4 MR7 and Enterprise Service 10.x before 10.2.2 log cleartext credentials during exception handling, which allows local users to obtain sensitive information by reading the exception log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-18T10:00:00.000Z
CVE-2014-1471 
SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T16:00:00.000Z
CVE-2014-1472 
Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T02:00:00.000Z
CVE-2014-1473 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to hijack the authentication of users for requests that modify HTML via unspecified vectors related to the "response web page."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T02:00:00.000Z
CVE-2014-1474 
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-1475 
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2014-1476 
The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-24T18:00:00.000Z
CVE-2014-1477 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1478 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1479 
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1480 
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1481 
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1482 
RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1483 
Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1484 
Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z
CVE-2014-1485 
The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T02:00:00.000Z