rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-15583 
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to a public project from a private one, the associated private labels and the private project namespace would be disclosed through the GitLab API.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: GitLab
product: GitLab CE/EE
Published: 2020-01-28T02:24:38.000Z
CVE-2019-15584 
A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: GitLab CE/EE
Published: 2019-12-20T21:02:40.000Z
CVE-2019-15585 
Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: GitLab
product: Gitlab CE/EE
Published: 2020-01-28T02:21:16.000Z
CVE-2019-15586 
A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - DOM (CWE-79)
Affected products: vendor: GitLab
product: Gitlab CE/EE
Published: 2020-01-28T02:14:59.000Z
CVE-2019-15587 
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Generic (CWE-79)
Affected products: vendor: n/a
product: Loofah (rubygem)
Published: 2019-10-22T20:07:47.000Z
CVE-2019-15588 
There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable, such as the Yum Configuration Capability.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: Nexus Repository Manager
Published: 2019-11-01T14:46:12.000Z
CVE-2019-15589 
An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: GitLab CE/EE
Published: 2019-12-18T21:00:39.000Z
CVE-2019-15590 
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be disclosed with the Group Search feature provided by Elasticsearch integration
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: GitLab
product: GitLab EE
Published: 2020-01-28T02:31:05.000Z
CVE-2019-15591 
An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: GitLab
Published: 2019-12-18T20:51:27.000Z
CVE-2019-15592 
GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: GitLab
Published: 2020-02-14T21:27:56.000Z
CVE-2019-15593 
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
Problem types: cwe_id: CWE-400
description: Denial of Service (CWE-400)
Affected products: vendor: n/a
product: GitLab
Published: 2019-11-22T21:57:26.000Z
CVE-2019-15594 
GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint.
Problem types: cwe_id: CWE-200
description: Information Disclosure (CWE-200)
Affected products: vendor: n/a
product: GitLab
Published: 2020-02-14T21:29:53.000Z
CVE-2019-15595 
A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: UniFi Video Server
Published: 2019-11-25T23:19:35.000Z
CVE-2019-15596 
A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: statics-server
Published: 2019-12-18T20:59:06.000Z
CVE-2019-15597 
A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: node-df
Published: 2019-12-18T20:58:51.000Z
CVE-2019-15598 
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: treekill
Published: 2019-12-18T20:58:31.000Z
CVE-2019-15599 
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
Problem types: cwe_id: CWE-94
description: Code Injection (CWE-94)
Affected products: vendor: n/a
product: tree-kill
Published: 2019-12-18T20:56:56.000Z
CVE-2019-15600 
A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
Problem types: cwe_id: CWE-22
description: Path Traversal (CWE-22)
Affected products: vendor: n/a
product: http_server
Published: 2019-12-18T20:56:21.000Z
CVE-2019-15602 
The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in files it serves.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: fileview
Published: 2020-01-06T16:32:41.000Z
CVE-2019-15603 
The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory listing.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: seeftl
Published: 2020-01-06T16:32:36.000Z
CVE-2019-15604 
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation (CWE-295)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-02-07T14:57:07.000Z
CVE-2019-15605 
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
Problem types: cwe_id: CWE-444
description: HTTP Request Smuggling (CWE-444)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-02-07T14:55:22.000Z
CVE-2019-15606 
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: NodeJS
product: Node
default_status: unaffected
Published: 2020-02-07T14:58:08.000Z
CVE-2019-15607 
A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: node-red
Published: 2020-01-28T02:13:16.000Z
CVE-2019-15608 
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
Problem types: cwe_id: CWE-840
description: Business Logic Errors (CWE-840)
Affected products: vendor: n/a
product: yarn
Published: 2020-03-15T17:08:13.000Z
CVE-2019-15609 
The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
Problem types: cwe_id: CWE-77
description: Command Injection - Generic (CWE-77)
Affected products: vendor: n/a
product: kill-port-process
Published: 2020-02-28T19:30:41.000Z
CVE-2019-15610 
Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Nextcloud Circles
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15611 
Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.
Problem types: cwe_id: CWE-657
description: Violation of Secure Design Principles (CWE-657)
Affected products: vendor: n/a
product: Nextcloud iOS
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15612 
A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.
Problem types: cwe_id: CWE-384
description: Session Fixation (CWE-384)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15613 
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
Problem types: cwe_id: CWE-20
description: Improper Input Validation (CWE-20)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15614 
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Nextcloud iOS App
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15615 
A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past.
Problem types: cwe_id: CWE-284
description: Improper Access Control - Generic (CWE-284)
Affected products: vendor: n/a
product: Nextcloud Android
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15616 
Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.
Problem types: cwe_id: CWE-93
description: CRLF Injection (CWE-93)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15617 
A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15618 
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Reflected (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15619 
Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (XSS) - Stored (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15620 
Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.
Problem types: cwe_id: CWE-287
description: Improper Authentication - Generic (CWE-287)
Affected products: vendor: n/a
product: Nextcloud Talk
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15621 
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15622 
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
Problem types: cwe_id: CWE-89
description: SQL Injection (CWE-89)
Affected products: vendor: n/a
product: Nextcloud Android
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15623 
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Problem types: cwe_id: CWE-359
description: Privacy Violation (CWE-359)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15624 
Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
Problem types: description: Privilege Escalation (CAPEC-233)
Affected products: vendor: n/a
product: Nextcloud Server
Published: 2020-02-04T19:08:57.000Z
CVE-2019-15625 
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
Problem types: description: Memory Usage
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2020-01-17T23:45:24.000Z
CVE-2019-15626 
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.
Problem types: description: Confidentiality Exposure
Affected products: vendor: Trend Micro
product: Deep Security Manager
Published: 2019-10-17T19:09:30.000Z
CVE-2019-15627 
Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. Please note that only Windows agents are affected.
Problem types: description: Local Arbitrary File Overwrite
Affected products: vendor: Trend Micro
product: Deep Security Agent
Published: 2019-10-17T19:09:33.000Z
CVE-2019-15628 
Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious program each time the service is started.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2019-12-02T15:45:14.000Z
CVE-2019-15629 
Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device.
Problem types: description: FLAG_MISUSE
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager for Android
Published: 2019-11-25T21:01:19.000Z
CVE-2019-15630 
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
Problem types: description: Directory Traversal (Local File Inclusion)
Affected products: vendor: Salesforce, Inc.
product: Mulesoft
vendor: Salesforce, Inc.
product: Mulesoft API Gateway
Published: 2019-08-30T16:56:14.000Z
CVE-2019-15631 
Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.
Problem types: description: Remote Code Execution
Affected products: vendor: MuleSoft
product: Mule CE/EE 3.x
vendor: MuleSoft
product: Mule API Gateway 2.x
Published: 2019-12-02T01:44:27.000Z
CVE-2019-15635 
An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, the password for the data source is revealed and sent to the server. From a browser, a prompt to save the credentials is generated, and the password can be revealed by simply checking the "Show password" box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-23T16:37:08.000Z
CVE-2019-15637 
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T16:21:07.000Z
CVE-2019-15638 
COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-04T14:50:22.000Z
CVE-2019-15639 
main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-09T12:50:30.000Z
CVE-2019-15640 
Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T16:51:17.000Z
CVE-2019-15641 
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T17:07:38.000Z
CVE-2019-15642 
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T17:07:47.000Z
CVE-2019-15643 
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:19:37.000Z
CVE-2019-15644 
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:22:49.000Z
CVE-2019-15645 
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:23:30.000Z
CVE-2019-15646 
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:36:04.000Z
CVE-2019-15647 
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:42:31.000Z
CVE-2019-15648 
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:44:46.000Z
CVE-2019-15649 
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T11:45:43.000Z
CVE-2019-15650 
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-27T12:23:05.000Z
CVE-2019-15651 
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T21:57:54.000Z
CVE-2019-15652 
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-22T17:23:24.000Z
CVE-2019-15653 
Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username are password values are a double md5 of the plaintext real value, i.e., md5(md5(value)).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-19T17:16:49.000Z
CVE-2019-15654 
Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management server. The request doesn't require any authentication and will lead to saving the DBconfig.cfg file. At the end of the file, the login information is stored in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-19T17:18:03.000Z
CVE-2019-15655 
D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request doesn't require any authentication and will lead to saving the configuration file. The password is stored in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-19T17:19:15.000Z
CVE-2019-15656 
D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management server because of username_v and password_v variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-19T17:20:13.000Z
CVE-2019-15657 
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-26T22:55:12.000Z