rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-2273 
Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: BUFFALO INC.
product: WMR-433
vendor: BUFFALO INC.
product: WMR-433W
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2274 
Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: BUFFALO INC.
product: WMR-433
vendor: BUFFALO INC.
product: WMR-433W
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2275 
WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: Sony Corporation
product: WG-C10
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2276 
Buffer overflow in WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: Sony Corporation
product: WG-C10
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2277 
WG-C10 v3.0.79 and earlier allows an attacker to bypass access restrictions to obtain or alter information stored in the external storage connected to the product via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Sony Corporation
product: WG-C10
Published: 2017-07-22T00:00:00.000Z
CVE-2017-2278 
The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Fails to verify SSL certificates
Affected products: vendor: IID, Inc.
product: RBB SPEED TEST App for Android
vendor: IID, Inc.
product: RBB SPEED TEST App for iOS
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2279 
Untrusted search path vulnerability in Tween Ver1.6.6.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Kiri
product: Tween
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2280 
WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-AX1167GR
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2281 
WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.
Problem types: description: OS Command Injection
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-AX1167GR
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2282 
Buffer overflow in WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
Problem types: description: Buffer Overflow
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-AX1167GR
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2283 
WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.
Problem types: description: Use of Hard-coded Credentials
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-G300R3
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2284 
Cross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Popup Maker
product: Popup Maker
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2285 
Cross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: SilkyPress
product: Simple Custom CSS and JS
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2286 
Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S), NFC Port Software Version 5.3.6.7 and earlier (for RC-S320, RC-S310/J1C, RC-S310/ED4C), PC/SC Activator for Type B Ver.1.2.1.0 and earlier, SFCard Viewer 2 Ver.2.5.0.0 and earlier, NFC Net Installer Ver.1.1.0.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Sony Corporation
product: NFC Port Software (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S)
vendor: Sony Corporation
product: NFC Port Software (for RC-S320, RC-S310/J1C, RC-S310/ED4C)
vendor: Sony Corporation
product: PC/SC Activator for Type B
vendor: Sony Corporation
product: SFCard Viewer 2
vendor: Sony Corporation
product: NFC Net Installer
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2287 
Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Sony Corporation
product: NFC Port Software remover
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2288 
Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Claybird
product: LhaForge
Published: 2017-08-02T16:00:00.000Z
CVE-2017-2289 
Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: KDDI CORPORATION
product: Installer of Qua station connection tool for Windows
Published: 2017-08-18T13:00:00.000Z
CVE-2017-2290 
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in mcollective-puppet-agent 1.12.1.
Problem types: description: Privilege Escalation
Affected products: vendor: Puppet
product: mcollective-puppet-agent plugin
Published: 2017-03-03T15:00:00.000Z
CVE-2017-2292 
Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.
Problem types: description: Remote Code Execution Via YAML Deserialization
Affected products: vendor: Puppet
product: mcollective, Puppet, Puppet Enterprise
Published: 2017-06-30T20:00:00.000Z
CVE-2017-2293 
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.
Problem types: description: Privilege Escalation
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-02-01T22:00:00.000Z
CVE-2017-2294 
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.
Problem types: description: client private keys insufficiently protected
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2017-07-05T15:00:00.000Z
CVE-2017-2295 
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
Problem types: description: Remote Code Execution
Affected products: vendor: Puppet
product: Puppet server
Published: 2017-07-05T15:00:00.000Z
CVE-2017-2296 
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
Problem types: description: Denial of Service
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-02-01T22:00:00.000Z
CVE-2017-2297 
Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5 and 2017.2.1. This only affects users with labeled tokens, which is not the default for tokens.
Problem types: description: Authentication Bypass
Affected products: vendor: Puppet
product: Puppet Enterprise
Published: 2018-02-01T22:00:00.000Z
CVE-2017-2298 
The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string "_pub.pem".
Problem types: description: missing input sanitization
Affected products: vendor: Puppet
product: mcollective
Published: 2017-06-30T20:00:00.000Z
CVE-2017-2299 
Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.
Problem types: description: Unsafe defaults affecting access controls
Affected products: vendor: Puppet
product: puppetlabs-apache
Published: 2017-09-15T18:00:00.000Z
CVE-2017-2300 
On Juniper Networks SRX Series Services Gateways chassis clusters running Junos OS 12.1X46 prior to 12.1X46-D65, 12.3X48 prior to 12.3X48-D40, 12.3X48 prior to 12.3X48-D60, flowd daemon on the primary node of an SRX Series chassis cluster may crash and restart when attempting to synchronize a multicast session created via crafted multicast packets.
Problem types: description: flowd daemon crash denial of service vulnerability
Affected products: vendor: Juniper Networks
product: Junos OS on SRX Series Services Gateways chassis cluster
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2301 
On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3 prior to 12.3R12-S2 or 12.3R13, 12.3X48 prior to 12.3X48-D40, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D12 or 14.1X53-D35, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R7, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D60, 15.1X53 prior to 15.1X53-D30 and DHCPv6 enabled, when a crafted DHCPv6 packet is received from a subscriber, jdhcpd daemon crashes and restarts. Repeated crashes of the jdhcpd process may constitute an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.
Problem types: description: jdhcpd daemon crash denial of service vulnerability
Affected products: vendor: Juniper Networks
product: Junos OS with DHCPv6 enabled
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2302 
On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, 12.3R13 prior to 12.3R13, 12.3X48 prior to 12.3X48-D35, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D40, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R6, 15.1 prior to 15.1F2 or 15.1R1, 15.1X49 prior to 15.1X49-D20 where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network based attacker can cause the Junos OS rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
Problem types: description: rpd daemon crash denial of service
Affected products: vendor: Juniper Networks
product: Junos OS where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2303 
On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, 12.3 prior to 12.3R13, 12.3X48 prior to 12.3X48-D30, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D35, 14.1X55 prior to 14.1X55-D35, 14.2 prior to 14.2R5, 15.1 prior to 15.1F6 or 15.1R3, 15.1X49 prior to 15.1X49-D30 or 15.1X49-D40, 15.1X53 prior to 15.1X53-D35, and where RIP is enabled, certain RIP advertisements received by the router may cause the RPD daemon to crash resulting in a denial of service condition.
Problem types: description: RPD daemon to crash denial of service
Affected products: vendor: Juniper Networks
product: Junos OS where RIP is enabled
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2304 
Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak'
Problem types: description: information leak
Affected products: vendor: Juniper Networks
product: Junos OS running on QFX3500, QFX3600, QFX5100, QFX5200, EX4300, EX4600 devices
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2305 
On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation.
Problem types: description: insufficient authorization check
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2306 
On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.
Problem types: description: insufficient authorization check leading to code execution
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2307 
A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.
Problem types: description: reflected cross site scripting vulnerability
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2308 
An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.
Problem types: description: XML external entity injection vulnerability
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2309 
On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web services are accessible over the network. This represents an information leak risk.
Problem types: description: information leak vulnerability
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2310 
A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, representing a network integrity risk.
Problem types: description: firewall bypass vulnerability
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2311 
On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a denial of service condition.
Problem types: description: denial of service vulnerability
Affected products: vendor: Juniper Networks
product: Junos Space
Published: 2017-05-30T14:00:00.000Z
CVE-2017-2312 
On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a small amount of the memory allocated for the rpd (routing protocol daemon) process. Over time, repeatedly receiving this type of LDP packet(s) will cause the memory to exhaust and the rpd process to crash and restart. It is not possible to free up the memory that has been consumed without restarting the rpd process. This issue affects Junos OS based devices with either IPv4 or IPv6 LDP enabled via the [protocols ldp] configuration (the native IPv6 support for LDP is available in Junos OS 16.1 and higher). The interface on which the packet arrives needs to have LDP enabled. The affected Junos versions are: 13.3 prior to 13.3R10; 14.1 prior to 14.1R8; 14.2 prior to 14.2R7-S6 or 14.2R8; 15.1 prior to 15.1F2-S14, 15.1F6-S4, 15.1F7, 15.1R4-S7, 15.1R5; 15.1X49 before 15.1X49-D70; 15.1X53 before 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 before 16.1R2. 16.2R1 and all subsequent releases have a resolution for this vulnerability.
Problem types: description: denial of service vulnerability due to memory leak
Affected products: vendor: Juniper Networks
product: Junos OS with LDP enabled
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2313 
Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process daemon) crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition. The affected Junos OS versions are: 15.1 prior to 15.1F2-S15, 15.1F5-S7, 15.1F6-S5, 15.1F7, 15.1R4-S7, 15.1R5-S2, 15.1R6; 15.1X49 prior to 15.1X49-D78, 15.1X49-D80; 15.1X53 prior to 15.1X53-D230, 15.1X53-D63, 15.1X53-D70; 16.1 prior to 16.1R3-S3, 16.1R4; 16.2 prior to 16.2R1-S3, 16.2R2; Releases prior to Junos OS 15.1 are unaffected by this vulnerability. 17.1R1, 17.2R1, and all subsequent releases have a resolution for this vulnerability.
Problem types: description: denial of service vulnerability
Affected products: vendor: Juniper Networks
product: Junos OS with BGP enabled
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2314 Junos: RPD crash due to malformed BGP OPEN message
Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. By continuously sending specially crafted BGP OPEN messages, an attacker can repeatedly crash the rpd process causing prolonged denial of service. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R12-S4, 12.3R13, 12.3R3-S4; 12.3X48 prior to 12.3X48-D50; 13.3 prior to 13.3R4-S11, 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior to 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R4-S7, 14.2R6-S4, 14.2R7; 15.1 prior to 15.1F2-S11, 15.1F4-S1-J1, 15.1F5-S3, 15.1F6, 15.1R4; 15.1X49 prior to 15.1X49-D100; 15.1X53 prior to 15.1X53-D33, 15.1X53-D50.
Problem types: description: routing protocol daemon (rpd) crash denial of service
Affected products: vendor: Juniper Networks
product: Junos OS
Published: 2017-07-14T14:00:00.000Z
CVE-2017-2315 
On Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, a vulnerability in IPv6 processing has been discovered that may allow a specially crafted IPv6 Neighbor Discovery (ND) packet destined to an EX Series Ethernet Switch to cause a slow memory leak. A malicious network-based packet flood of these crafted IPv6 NDP packets may eventually lead to resource exhaustion and a denial of service. The affected Junos OS versions are: 12.3 prior to 12.3R12-S4, 12.3R13; 13.3 prior to 13.3R10; 14.1 prior to 14.1R8-S3, 14.1R9; 14.1X53 prior ro 14.1X53-D12, 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R6-S4, 14.2R7-S6, 14.2R8; 15.1 prior to 15.1R5; 16.1 before 16.1R3; 16.2 before 16.2R1-S3, 16.2R2. 17.1R1 and all subsequent releases have a resolution for this vulnerability.
Problem types: description: denial of service vulnerability due to memory leak
Affected products: vendor: Juniper Networks
product: Junos OS on EX series Ethernet Switches with IPv6 enabled
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2316 
A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to cause a buffer overflow leading to a denial of service.
Problem types: description: buffer overflow vulnerability leading to a denial of service
Affected products: vendor: Juniper Networks
product: NorthStar Controller Application
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2317 
A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause denials of services to underlying database tables leading to potential information disclosure, modification of system states, and partial to full denial of services relying upon data modified by an attacker.
Problem types: description: denials of service, potential information disclosure or modification of system states
Affected products: vendor: Juniper Networks
product: NorthStar Controller Application
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2318 
A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to read log files which will compromise the integrity of the system, or provide elevation of privileges.
Problem types: description: read log files, compromise the integrity of the system or elevation of privileges
Affected products: vendor: Juniper Networks
product: NorthStar Controller Application
Published: 2017-04-24T15:00:00.000Z
CVE-2017-2319 
A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication, leading to managed systems being compromised or services being denied to authentic end users and systems as a result.
Problem types: description: vulnerability that may compromise the system's confidentiality or integrity or denial of service
Affected products: vendor: Juniper Networks
product: NorthStar Controller Application
Published: 2017-04-24T15:00:00.000Z