- Security-news - lists.drupal.org

WissKI - Critical - Access bypass - SA-CONTRIB-2026-059
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-059 Project: WissKI [1] Date: 2026-June-24 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.2.0 CVE IDs: CVE-2026-13239 Description: The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass. This vulnerability is mitigated by the fact that it is specific to the wisski_mirador submodule. Solution: Install the latest version: * If you use the WissKI module version 8.x-4.1, upgrade to WissKI 8.x-4.2 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * knurg [5] Coordinated By: * cilefen (cilefen) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/wisski [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/wisski/releases/8.x-4.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/knurg [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185226-wisski-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-058 Project: Commerce Realex / Global Payments [1] Date: 2026-June-24 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Affected versions: <3.0.2 CVE IDs: CVE-2026-13238 Description: This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect. When the gateway is configured with the *redirect* payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments. The *lightbox* payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected. Solution: Install the latest version: * If you use the commerce_realex module <=3.0.1, upgrade to commerce_realex 3.0.2 [3]. The redirect payment response is now cryptographically verified against the merchant shared secret . Sites that cannot update immediately should disable this payment gateway, until the update can be applied. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] * Jaime Seuma (jaims-dev) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_… [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_realex [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_realex/releases/3.0.2 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/jaims-dev [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185236-commerce_realex-security/-/work_… [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-057 Project: AI Agents [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure, Access bypass Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1 CVE IDs: CVE-2026-13237 Description: This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. Under certain circumstances, the agent inherits deterministic parameters when invoking the same tool in one request, which can lead to information disclosure. Solution: Install the latest version: * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3] * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4] * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5] Reported By: * Andrew Belcher (andrewbelcher) [6] * Rob Edwards (rob_e) [7] Fixed By: * Andrew Belcher (andrewbelcher) [8] * Marcus Johansson (marcus_johansson) [9] * Rob Edwards (rob_e) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team * Drew Webber (mcdruid) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [15] ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/ai_agents [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_agents/releases/1.1.4 [4] https://www.drupal.org/project/ai_agents/releases/1.2.5 [5] https://www.drupal.org/project/ai_agents/releases/1.3.1 [6] https://www.drupal.org/u/andrewbelcher [7] https://www.drupal.org/u/rob_e [8] https://www.drupal.org/u/andrewbelcher [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/rob_e [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/u/mcdruid [14] https://www.drupal.org/u/poker10 [15] https://git.drupalcode.org/security/185010-ai_agents-security/-/work_items/1 [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-056 Project: AI Agents [1] Date: 2026-June-24 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.1.4 || >=1.2.0 <1.2.5 || >=1.3.0 <1.3.1 CVE IDs: CVE-2026-13236 Description: This module provides the entity type and runtime for Drupal AI Agents, enabling agents to use tools. The module does not sufficiently check the required permissions when a tool loads content entities. This vulnerability is mitigated by the fact that an agent must be configured to use the affected tool, and an attacker must have access to that agent. Solution: Install the latest version: * If you use the AI Agents module 1.1.3, upgrade to AI Agents 1.1.4 [3] * If you use the AI Agents module 1.2.4 upgrade to AI Agents 1.2.5 [4] * If you use the AI Agents module 1.3.0 upgrade to AI Agents 1.3.1 [5] Reported By: * Kuniyoshi Noguchi (kuninogu) [6] Fixed By: * Artem Dmitriiev (a.dmitriiev) [7] * AKHIL BABU (akhil babu) [8] * harivansh sharma (harivansh) [9] * Kuniyoshi Noguchi (kuninogu) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Bram Driesen (bramdriesen) [12] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586041-ai_agents-security/-/work_items… [13] ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/ai_agents [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_agents/releases/1.1.4 [4] https://www.drupal.org/project/ai_agents/releases/1.2.5 [5] https://www.drupal.org/project/ai_agents/releases/1.3.1 [6] https://www.drupal.org/u/kuninogu [7] https://www.drupal.org/u/admitriiev [8] https://www.drupal.org/u/akhil-babu [9] https://www.drupal.org/u/harivansh [10] https://www.drupal.org/u/kuninogu [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/bramdriesen [13] https://git.drupalcode.org/security/3586041-ai_agents-security/-/work_items… [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-055 Project: AI (Artificial Intelligence) [1] Date: 2026-June-24 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-13235 Description: This module enables you to utilize an agent to use Drupal core actions tools with bypassed access. Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions. This vulnerability is mitigated by the fact that an attacker must have access to communicate with an affected agent, the site must be configured to expose the affected tools to non-privileged users. Solution: Install the latest version: * If you use the AI module 1.2.16, upgrade to AI 1.2.17 [3] * If you use the AI module 1.3.7 upgrade to AI 1.3.8 [4] * If you use the AI module 1.4.2 upgrade to AI 1.4.3 [5] Reported By: * AKHIL BABU (akhil babu) [6] * Kuniyoshi Noguchi (kuninogu) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Marcus Johansson (marcus_johansson) [9] * Dezső Biczó (mxr576) [10] * Valery Lourie (valthebald) [11] Coordinated By: * Bram Driesen (bramdriesen) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586526-ai-security/-/work_items/1 [16] ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.2.17 [4] https://www.drupal.org/project/ai/releases/1.3.8 [5] https://www.drupal.org/project/ai/releases/1.4.3 [6] https://www.drupal.org/u/akhil-babu [7] https://www.drupal.org/u/kuninogu [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/marcus_johansson [10] https://www.drupal.org/u/mxr576 [11] https://www.drupal.org/u/valthebald [12] https://www.drupal.org/u/bramdriesen [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/mcdruid [15] https://www.drupal.org/u/poker10 [16] https://git.drupalcode.org/security/3586526-ai-security/-/work_items/1 [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-054 Project: AI (Artificial Intelligence) [1] Date: 2026-June-24 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure / Cross-site Scripting Affected versions: <1.2.17 || >=1.3.0 <1.3.8 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-13234 Description: The module and certain submodules (AI Automators, AI Translate, AI API Explorer, AI Content Suggestions) provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to Cross Site Scripting, or exposing secret communications in the context of the LLM request. This vulnerability is mitigated by the fact that an attacker must be able to inject text into prompts to create an attack. Solution: Install the latest version: * If you use the AI module 1.2.16, upgrade to AI 1.2.17 [3] * If you use the AI module 1.3.7 upgrade to AI 1.3.8 [4] * If you use the AI module 1.4.2 upgrade to AI 1.4.3 [5] Reported By: * Drew Webber (mcdruid) [6] of the Drupal Security Team Fixed By: * Artem Dmitriiev (a.dmitriiev) [7] * Abhisek Mazumdar (abhisekmazumdar) [8] * AKHIL BABU (akhil babu) [9] * Marcus Johansson (marcus_johansson) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Drew Webber (mcdruid) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/3586527-ai-security/-/work_items/1 [14] ------------------------------------------------------------------------------ Contribution record [15] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.2.17 [4] https://www.drupal.org/project/ai/releases/1.3.8 [5] https://www.drupal.org/project/ai/releases/1.4.3 [6] https://www.drupal.org/u/mcdruid [7] https://www.drupal.org/u/admitriiev [8] https://www.drupal.org/u/abhisekmazumdar [9] https://www.drupal.org/u/akhil-babu [10] https://www.drupal.org/u/marcus_johansson [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/poker10 [14] https://git.drupalcode.org/security/3586527-ai-security/-/work_items/1 [15] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-053 Project: OpenAI Provider [1] Date: 2026-June-24 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Server-side Request Forgery Affected versions: <1.1.1 || >=1.2.0 <1.2.2 CVE IDs: CVE-2026-13233 Description: This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability. This vulnerability is mitigated by the fact that an attacker must have the access to change the host url and a way to generate AI-generated images. Solution: Install the latest version: * If you use the OpenAI Provider module 1.1.0, upgrade to OpenAI Provider 1.1.1 [3] * If you use the OpenAI module 1.2.1 upgrade to OpenAI Provider 1.2.2 [4] Reported By: * Kuniyoshi Noguchi (kuninogu) [5] Fixed By: * Artem Dmitriiev (a.dmitriiev) [6] * Kuniyoshi Noguchi (kuninogu) [7] * Marcus Johansson (marcus_johansson) [8] Coordinated By: * Bram Driesen (bramdriesen) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185237-ai_provider_openai-security/-/wo… [11] ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/ai_provider_openai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_provider_openai/releases/1.1.1 [4] https://www.drupal.org/project/ai_provider_openai/releases/1.2.2 [5] https://www.drupal.org/u/kuninogu [6] https://www.drupal.org/u/admitriiev [7] https://www.drupal.org/u/kuninogu [8] https://www.drupal.org/u/marcus_johansson [9] https://www.drupal.org/u/bramdriesen [10] https://www.drupal.org/u/greggles [11] https://git.drupalcode.org/security/185237-ai_provider_openai-security/-/wo… [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-052 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass / Insecure Direct Object Reference (IDOR) Affected versions: <2.8.0 CVE IDs: CVE-2026-13232 Description: This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote. The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "give feedback". Note: "give feedback" is granted to anonymous and authenticated by default on install. Solution: Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The comment endpoint now requires an HMAC-signed token bound to the specific feedback row (issued only to the visitor who cast that vote), and a comment may be written only once, preventing both forgery of arbitrary ids and replay. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_i… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://git.drupalcode.org/security/185232-admin_feedback-security/-/work_i… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051
by security-news＠drupal.org 24 Jun '26

24 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-051 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.8.0 CVE IDs: CVE-2026-13231 Description: This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback". Solution: Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_i… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_i… [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050
by security-news＠drupal.org 17 Jun '26

17 Jun '26

View online: https://www.drupal.org/sa-contrib-2026-050 Project: Plotly.js Graphing [1] Date: 2026-June-17 Security risk: *Critical* 19 ∕ 25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: PHP object injection Affected versions: <3.0.2 CVE IDs: CVE-2026-55810 Description: The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library. The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when the data are unserialized. This vulnerability is mitigated by the fact that an attacker must have permission to edit a content entity with an attached plotly_js_graph field. In addition, the core JSON:API module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", which is not the default, or the attacker needs some other way to edit field values directly. Solution: Install the latest version: * If you use the Plotly.js Graphing module for Drupal, upgrade to plotly_js-3.0.2 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Stephen Mustgrave (smustgrave) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Jess (xjm) [8] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185192-plotly_js-security/-/work_items/1 [9] ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/plotly_js [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/plotly_js/releases/3.0.2 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/smustgrave [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/xjm [9] https://git.drupalcode.org/security/185192-plotly_js-security/-/work_items/1 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0