# CVEs published 2023-09-05

123 CVEs were published on September 5, 2023: 15 critical, 42 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-4485](https://cve.now/CVE-2023-4485.md): ARDEREG Sistemas SCADA SQL Injection (CVSS 9.8, ARDEREG Sistemas SCADA)
- [CVE-2023-4487](https://cve.now/CVE-2023-4487.md): GE Digital CIMPLICITY Process Control (CVSS 7.8, GE Digital CIMPLICITY)
- [CVE-2023-4764](https://cve.now/CVE-2023-4764.md): Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (UR (no CVSS, Google Chrome)
- [CVE-2023-4763](https://cve.now/CVE-2023-4763.md): Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2023-4762](https://cve.now/CVE-2023-4762.md): Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, KEV, Google Chrome)
- [CVE-2023-4761](https://cve.now/CVE-2023-4761.md): Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer pro (CVSS 8.1, Google Chrome)
- [CVE-2023-30534](https://cve.now/CVE-2023-30534.md): Insecure Deserialization in Cacti (CVSS 4.3, cacti)
- [CVE-2023-31132](https://cve.now/CVE-2023-31132.md): Cacti Privilege Escalation (CVSS 7.8, cacti)
- [CVE-2023-39362](https://cve.now/CVE-2023-39362.md): Authenticated command injection in SNMP options of a Device (CVSS 7.2, cacti)
- [CVE-2023-39364](https://cve.now/CVE-2023-39364.md): Open redirect in change password functionality in Cacti (CVSS 3.5, cacti)
- [CVE-2023-39516](https://cve.now/CVE-2023-39516.md): Stored Cross-Site-Scripting on data\_sources.php debug html-block in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39365](https://cve.now/CVE-2023-39365.md): Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti (CVSS 4.6, cacti)
- [CVE-2023-39357](https://cve.now/CVE-2023-39357.md): A Defect in sql\_save() Causes Multiple SQL Injection Vulnerabilities in Cacti (CVSS 8.8, cacti)
- [CVE-2023-39358](https://cve.now/CVE-2023-39358.md): Authenticated SQL injection vulnerability in reports\_user.php in Cacti (CVSS 8.8, cacti)
- [CVE-2023-39359](https://cve.now/CVE-2023-39359.md): Authenticated SQL injection vulnerability in graphs.php in Cacti (CVSS 8.8, cacti)
- [CVE-2023-39361](https://cve.now/CVE-2023-39361.md): Unauthenticated SQL Injection in graph\_view.php in Cacti (CVSS 9.8, cacti)
- [CVE-2023-39360](https://cve.now/CVE-2023-39360.md): Reflected Cross-site Scripting in graphs\_new.php in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39366](https://cve.now/CVE-2023-39366.md): Stored Cross-site Scripting in data\_sources.php through Device-Name in 'select' input in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39510](https://cve.now/CVE-2023-39510.md): Stored Cross-site Scripting in reports\_admin.php through Device-Name in 'select' input in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39512](https://cve.now/CVE-2023-39512.md): Stored Cross-site Scripting on data\_sources.php device name view in Cacti (CVSS 6.1, cacti)
- [CVE-2023-4310](https://cve.now/CVE-2023-4310.md): BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability whic (no CVSS, BeyondTrust Privileged Remote Access · BeyondTrust Remote S…)
- [CVE-2023-39513](https://cve.now/CVE-2023-39513.md): Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39515](https://cve.now/CVE-2023-39515.md): Stored Cross-site Scripting on data\_debug.php datasource path view in Cacti (CVSS 6.1, cacti)
- [CVE-2023-39514](https://cve.now/CVE-2023-39514.md): Stored Cross-site Scripting on graphs.php data template formated name view in Cacti (CVSS 6.1, cacti)
- [CVE-2020-10128](https://cve.now/CVE-2020-10128.md): SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site Scripting (no CVSS, SearchBlox)
- [CVE-2023-4178](https://cve.now/CVE-2023-4178.md): Authentication Bypass in Neutron Smart VMS (CVSS 9.8, Neutron Smart VMS)
- [CVE-2023-4531](https://cve.now/CVE-2023-4531.md): SQLi in Mestavs E-commerce Software (CVSS 9.8, Mestav Software E-commerce Software)
- [CVE-2023-4781](https://cve.now/CVE-2023-4781.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2023-41317](https://cve.now/CVE-2023-41317.md): Unnamed "Subscription" operation results in Denial-of-Service in apollographql/router (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2023-4034](https://cve.now/CVE-2023-4034.md): SQLi in Smartrise Document Management System (CVSS 9.8, Digita Information Technology Smartrise Document Management…)
- [CVE-2023-3616](https://cve.now/CVE-2023-3616.md): SQLi in Mava Softwares Hotel Management System (CVSS 9.8, Mava Software Hotel Management System)
- [CVE-2023-35072](https://cve.now/CVE-2023-35072.md): SQLi in Coyav Travels Proagent (CVSS 9.8, Coyav Travel Proagent)
- [CVE-2023-35068](https://cve.now/CVE-2023-35068.md): SQLi in BMAs Personnel Tracking System (CVSS 9.8, BMA Personnel Tracking System)
- [CVE-2023-35065](https://cve.now/CVE-2023-35065.md): SQLi in Osofts Paint Production Management (CVSS 9.8, Osoft Paint Production Management)
- [CVE-2023-3375](https://cve.now/CVE-2023-3375.md): Unrestricted File Upload in Bookreen (CVSS 7.2, Unisign Bookreen)
- [CVE-2023-3374](https://cve.now/CVE-2023-3374.md): Privilege Escalation in Bookreen (CVSS 9.8, Unisign Bookreen)
- [CVE-2023-31242](https://cve.now/CVE-2023-31242.md): An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. (CVSS 8.1, Open Automation Software OAS Platform)
- [CVE-2023-34998](https://cve.now/CVE-2023-34998.md): An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. (CVSS 8.1, Open Automation Software OAS Platform)
- [CVE-2023-32615](https://cve.now/CVE-2023-32615.md): A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. (CVSS 6.5, Open Automation Software OAS Platform)
- [CVE-2023-34317](https://cve.now/CVE-2023-34317.md): An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18 (CVSS 6.5, Open Automation Software OAS Platform)
- [CVE-2023-34994](https://cve.now/CVE-2023-34994.md): An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OA (CVSS 3.1, Open Automation Software OAS Platform)
- [CVE-2023-32271](https://cve.now/CVE-2023-32271.md): An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Plat (CVSS 6.5, Open Automation Software OAS Platform)
- [CVE-2023-35124](https://cve.now/CVE-2023-35124.md): An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Plat (CVSS 3.1, Open Automation Software OAS Platform)
- [CVE-2023-34353](https://cve.now/CVE-2023-34353.md): An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00 (CVSS 7.5, Open Automation Software OAS Platform)
- [CVE-2023-4778](https://cve.now/CVE-2023-4778.md): Out-of-bounds Read in gpac/gpac (CVSS 5.9, gpac/gpac)
- [CVE-2023-4480](https://cve.now/CVE-2023-4480.md): Arbitrary File Read in Fusion File Manager (CVSS 5.5, PHPFusion)
- [CVE-2023-40743](https://cve.now/CVE-2023-40743.md): Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService (CVSS 9.8, Apache Software Foundation Apache Axis · org.apache.axis… +1)
- [CVE-2023-2453](https://cve.now/CVE-2023-2453.md): Local file Inclusion (LFI) in Forum Infusion via Directory Traversal (CVSS 8.8, PHPFusion)
- [CVE-2023-20898](https://cve.now/CVE-2023-20898.md): Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 300 (CVSS 4.2, Salt)
- [CVE-2023-20897](https://cve.now/CVE-2023-20897.md): Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. (CVSS 5.3, Salt)
- [CVE-2023-38569](https://cve.now/CVE-2023-38569.md): Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary scrip (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2023-36492](https://cve.now/CVE-2023-36492.md): Reflected cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote unauthenticated attacker to execute an arbitrary (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2023-40705](https://cve.now/CVE-2023-40705.md): Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inje (no CVSS, i-PRO Co. VI Web Client)
- [CVE-2023-40535](https://cve.now/CVE-2023-40535.md): Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inj (no CVSS, i-PRO Co. VI Web Client)
- [CVE-2023-39938](https://cve.now/CVE-2023-39938.md): Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitrary (no CVSS, i-PRO Co. VI Web Client)
- [CVE-2023-38574](https://cve.now/CVE-2023-38574.md): Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web site (no CVSS, i-PRO Co. VI Web Client)
- [CVE-2023-39448](https://cve.now/CVE-2023-39448.md): Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on the (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2023-4540](https://cve.now/CVE-2023-4540.md): DoS in lua-http library (CVSS 7.5, Daurnimator lua-http)
- [CVE-2023-28543](https://cve.now/CVE-2023-28543.md): Out of Bounds read in SNPE Library (CVSS 8.1, Qualcomm Snapdragon)
- [CVE-2023-33021](https://cve.now/CVE-2023-33021.md): Use After Free in Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33020](https://cve.now/CVE-2023-33020.md): Improper Authorization in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33019](https://cve.now/CVE-2023-33019.md): Improper Authorization in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33016](https://cve.now/CVE-2023-33016.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33015](https://cve.now/CVE-2023-33015.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-28584](https://cve.now/CVE-2023-28584.md): Improper Authorization in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-28581](https://cve.now/CVE-2023-28581.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-28573](https://cve.now/CVE-2023-28573.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28567](https://cve.now/CVE-2023-28567.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28565](https://cve.now/CVE-2023-28565.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28564](https://cve.now/CVE-2023-28564.md): Use of Out-of-range Pointer Offset in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28562](https://cve.now/CVE-2023-28562.md): Buffer Copy Without Checking Size of Input in QESL (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-28560](https://cve.now/CVE-2023-28560.md): Buffer Copy Without Checking Size of Input in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28559](https://cve.now/CVE-2023-28559.md): Buffer Copy Without Checking Size of Input in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28558](https://cve.now/CVE-2023-28558.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28557](https://cve.now/CVE-2023-28557.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28549](https://cve.now/CVE-2023-28549.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28548](https://cve.now/CVE-2023-28548.md): Improper Validation of Array Index in WLAN HAL (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28544](https://cve.now/CVE-2023-28544.md): Buffer Copy without Checking the Size of Input in WLAN Firmware (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28538](https://cve.now/CVE-2023-28538.md): Stack-based Buffer Overflow in WIN Product (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-21667](https://cve.now/CVE-2023-21667.md): Buffer Over-read in Bluetooth HOST (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2023-21664](https://cve.now/CVE-2023-21664.md): Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-21663](https://cve.now/CVE-2023-21663.md): Improper Restrictions of Operations within the Bounds of a Memory Buffer in Display (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-21662](https://cve.now/CVE-2023-21662.md): Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core Platform (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-21655](https://cve.now/CVE-2023-21655.md): Integer Overflow or Wraparound in Display (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-21654](https://cve.now/CVE-2023-21654.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-21653](https://cve.now/CVE-2023-21653.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21646](https://cve.now/CVE-2023-21646.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-21644](https://cve.now/CVE-2023-21644.md): Integer Overflow to Buffer Overflow in RIL (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-21636](https://cve.now/CVE-2023-21636.md): Improper Validation of Array Index in Linux (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-40534](https://cve.now/CVE-2022-40534.md): Improper Validation of Array Index in Audio (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40524](https://cve.now/CVE-2022-40524.md): Buffer over-read in Modem (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33275](https://cve.now/CVE-2022-33275.md): Improper validation of array index in WLAN HAL (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33220](https://cve.now/CVE-2022-33220.md): Buffer over-read in Automotive multimedia (CVSS 5.1, Qualcomm Snapdragon)
- [CVE-2023-4748](https://cve.now/CVE-2023-4748.md): Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversal (CVSS 6.3, Yongyou UFIDA-NC)
- [CVE-2023-4636](https://cve.now/CVE-2023-4636.md): WordPress File Sharing Plugin \<= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, deepakkite File Sharing & Download Manager – User Private F…)
- [CVE-2023-35906](https://cve.now/CVE-2023-35906.md): IBM Aspera Faspex security bypass (CVSS 5.3, IBM Aspera Faspex)
- [CVE-2023-22870](https://cve.now/CVE-2023-22870.md): IBM Aspera Faspex information disclosure (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2023-29261](https://cve.now/CVE-2023-29261.md): IBM Sterling Secure Proxy information disclosure (CVSS 5.1, IBM Sterling Secure Proxy)
- [CVE-2015-1390](https://cve.now/CVE-2015-1390.md): Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator. (no CVSS)
- [CVE-2015-1391](https://cve.now/CVE-2015-1391.md): Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism. (no CVSS)
- [CVE-2015-2201](https://cve.now/CVE-2015-2201.md): Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users. (no CVSS)
- [CVE-2015-2202](https://cve.now/CVE-2015-2202.md): Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS. (no CVSS)
- [CVE-2017-9453](https://cve.now/CVE-2017-9453.md): BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass. (CVSS 9.0)
- [CVE-2020-35593](https://cve.now/CVE-2020-35593.md): BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. (no CVSS)
- [CVE-2021-40546](https://cve.now/CVE-2021-40546.md): Tenda AC6 US\_AC6V4.0RTL\_V02.03.01.26\_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device cras (no CVSS)
- [CVE-2022-41763](https://cve.now/CVE-2022-41763.md): An issue was discovered in NOKIA AMS 9.7.05. (no CVSS)
- [CVE-2023-34637](https://cve.now/CVE-2023-34637.md): A stored cross-site scripting (XSS) vulnerability in IsarNet AG IsarFlow v5.23 allows authenticated attackers to execute arbitrary web scrip (CVSS 5.4)
- [CVE-2023-36307](https://cve.now/CVE-2023-36307.md): ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image o (no CVSS, simonwaldherr.de/go/zplgfa)
- [CVE-2023-36308](https://cve.now/CVE-2023-36308.md): disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a craf (no CVSS, github.com/disintegration/imaging)
- [CVE-2023-36361](https://cve.now/CVE-2023-36361.md): Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p\_table\_name parameter. (CVSS 9.8)
- [CVE-2023-39598](https://cve.now/CVE-2023-39598.md): Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafte (no CVSS)
- [CVE-2023-39654](https://cve.now/CVE-2023-39654.md): abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search\_to\_symbol\_dict. (no CVSS)
- [CVE-2023-39681](https://cve.now/CVE-2023-39681.md): Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email\_outgoing parameter at /Configuration.php. (no CVSS)
- [CVE-2023-40918](https://cve.now/CVE-2023-40918.md): KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. (no CVSS)
- [CVE-2023-41009](https://cve.now/CVE-2023-41009.md): File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authoriz (no CVSS)
- [CVE-2023-41012](https://cve.now/CVE-2023-41012.md): An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code (no CVSS)
- [CVE-2023-41107](https://cve.now/CVE-2023-41107.md): TEF portal 2023-07-17 is vulnerable to a persistent cross site scripting (XSS)attack. (no CVSS)
- [CVE-2023-41108](https://cve.now/CVE-2023-41108.md): TEF portal 2023-07-17 is vulnerable to authenticated remote code execution. (no CVSS)
- [CVE-2023-41507](https://cve.now/CVE-2023-41507.md): Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, di (no CVSS)
- [CVE-2023-41508](https://cve.now/CVE-2023-41508.md): A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. (no CVSS)
- [CVE-2023-41908](https://cve.now/CVE-2023-41908.md): Cerebrate before 1.15 lacks the Secure attribute for the session cookie. (no CVSS)
- [CVE-2023-41909](https://cve.now/CVE-2023-41909.md): An issue was discovered in FRRouting FRR through 9.0. (no CVSS)
- [CVE-2023-41910](https://cve.now/CVE-2023-41910.md): An issue was discovered in lldpd before 1.0.17. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.