CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
4755 vulnerabilities reference this CWE, most recent first.
GHSA-FF3M-68VJ-H86P
Vulnerability from github – Published: 2023-06-27 15:30 – Updated: 2023-06-27 17:15Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.sourceforge.plantuml:plantuml-mit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2023.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "net.sourceforge.plantuml:plantuml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2023.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3432"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-27T17:15:16Z",
"nvd_published_at": "2023-06-27T15:15:11Z",
"severity": "HIGH"
},
"details": "Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.",
"id": "GHSA-ff3m-68vj-h86p",
"modified": "2023-06-27T17:15:16Z",
"published": "2023-06-27T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3432"
},
{
"type": "WEB",
"url": "https://github.com/plantuml/plantuml/commit/b32500bb61ae617bb312496d6d832e4be8190797"
},
{
"type": "PACKAGE",
"url": "https://github.com/plantuml/plantuml"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/8ac3316f-431c-468d-87e4-3dafff2ecf51"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FV7XL3CY3K3K5ER3ASMEQA546MIQQ7QM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "PlantUML Server-Side Request Forgery vulnerability"
}
GHSA-FF75-FG5H-FJX7
Vulnerability from github – Published: 2026-04-28 00:31 – Updated: 2026-04-28 00:31A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]/[...path]/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
{
"affected": [],
"aliases": [
"CVE-2026-7177"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-27T22:16:18Z",
"severity": "MODERATE"
},
"details": "A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]/[...path]/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.",
"id": "GHSA-ff75-fg5h-fjx7",
"modified": "2026-04-28T00:31:40Z",
"published": "2026-04-28T00:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7177"
},
{
"type": "WEB",
"url": "https://github.com/ChatGPTNextWeb/NextChat/issues/6742"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/da6b00024f5b7e1d4fa0658c19b77fbf"
},
{
"type": "WEB",
"url": "https://github.com/ChatGPTNextWeb/NextChat"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/797645"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359779"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/359779/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FF78-2Q7Q-3GPW
Vulnerability from github – Published: 2024-02-06 00:30 – Updated: 2024-02-13 15:31Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.
{
"affected": [],
"aliases": [
"CVE-2023-22817"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T22:15:54Z",
"severity": "MODERATE"
},
"details": "Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed\u00a0by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.\u00a0\n",
"id": "GHSA-ff78-2q7q-3gpw",
"modified": "2024-02-13T15:31:10Z",
"published": "2024-02-06T00:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22817"
},
{
"type": "WEB",
"url": "https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FFM6-VVPH-G5F5
Vulnerability from github – Published: 2026-06-22 17:01 – Updated: 2026-06-22 17:01Summary
The OpenCTI platform’s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs.
This results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems.
Impact
OpenCTI’s data ingestion feature can allow an attacker to make the application send HTTP requests to arbitrary internal or external endpoints. This means an attacker could reach internal services that are not exposed publicly, such as Elasticsearch, Redis, or RabbitMQ, and potentially extract sensitive data or manipulate internal components. In cloud environments, the attacker could target metadata services like AWS, Azure, or GCP to obtain credentials and configuration details, which could lead to full compromise of the infrastructure. Even though the SSRF is semi-blind and the attacker may not see the full response, the ability to interact with internal services can enable enumeration, data exfiltration, and in some cases remote code execution if internal APIs expose dangerous functionality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pycti"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.8.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-21887"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-22T17:01:22Z",
"nvd_published_at": "2026-03-12T17:16:36Z",
"severity": "HIGH"
},
"details": "### Summary\nThe OpenCTI platform\u2019s data ingestion feature accepts user-supplied URLs without validation and uses the Axios HTTP client with its default configuration (allowAbsoluteUrls: true). This allows attackers to craft requests to arbitrary endpoints, including internal services, because Axios will accept and process absolute URLs.\n\nThis results in a semi-blind SSRF, as responses may not be fully visible but can still impact internal systems.\n\n### Impact\nOpenCTI\u2019s data ingestion feature can allow an attacker to make the application send HTTP requests to arbitrary internal or external endpoints. This means an attacker could reach internal services that are not exposed publicly, such as Elasticsearch, Redis, or RabbitMQ, and potentially extract sensitive data or manipulate internal components. In cloud environments, the attacker could target metadata services like AWS, Azure, or GCP to obtain credentials and configuration details, which could lead to full compromise of the infrastructure. Even though the SSRF is semi-blind and the attacker may not see the full response, the ability to interact with internal services can enable enumeration, data exfiltration, and in some cases remote code execution if internal APIs expose dangerous functionality.",
"id": "GHSA-ffm6-vvph-g5f5",
"modified": "2026-06-22T17:01:22Z",
"published": "2026-06-22T17:01:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-ffm6-vvph-g5f5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21887"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenCTI-Platform/opencti"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pycti/PYSEC-2026-118.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature"
}
GHSA-FFVM-PVFJ-68Q9
Vulnerability from github – Published: 2022-11-04 19:01 – Updated: 2022-11-07 19:00A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network. {{value}} ["%7b%7bvalue%7d%7d"])}]]
{
"affected": [],
"aliases": [
"CVE-2022-20951"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-04T18:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network. {{value}} [\"%7b%7bvalue%7d%7d\"])}]]",
"id": "GHSA-ffvm-pvfj-68q9",
"modified": "2022-11-07T19:00:19Z",
"published": "2022-11-04T19:01:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20951"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-ssrf-BJeQfpp"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-ssrf-BJeQfpp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FFXG-5F8M-H72J
Vulnerability from github – Published: 2024-08-05 06:30 – Updated: 2024-08-30 19:56A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "rocket.chat"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-39713"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-05T15:14:20Z",
"nvd_published_at": "2024-08-05T05:15:39Z",
"severity": "HIGH"
},
"details": "A Server-Side Request Forgery (SSRF) affects Rocket.Chat\u0027s Twilio webhook endpoint before version 6.10.1.",
"id": "GHSA-ffxg-5f8m-h72j",
"modified": "2024-08-30T19:56:58Z",
"published": "2024-08-05T06:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39713"
},
{
"type": "WEB",
"url": "https://github.com/RocketChat/Rocket.Chat/commit/ce072a1a70c86f90a4f502cdc0bad92d79f6e6e9"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1886954"
},
{
"type": "PACKAGE",
"url": "https://github.com/RocketChat/Rocket.Chat"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability"
}
GHSA-FG3X-RWQ9-74CW
Vulnerability from github – Published: 2022-05-14 02:20 – Updated: 2023-07-25 19:19An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.gitea.io/gitea"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.0-rc1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "gogs.io/gogs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-15192"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-25T19:19:22Z",
"nvd_published_at": "2018-08-08T02:29:00Z",
"severity": "HIGH"
},
"details": "An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.",
"id": "GHSA-fg3x-rwq9-74cw",
"modified": "2023-07-25T19:19:22Z",
"published": "2022-05-14T02:20:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15192"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/issues/4624"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/issues/5366"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/pull/17482"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/pull/6002"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/commit/599ff1c054e436daa4dc3f049aa8661d9c2395f9"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/commit/22717a1c064511cf37c46af5e650baf7184cf25b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Gogs and Gitea SSRF Vulnerability"
}
GHSA-FG6V-9R8W-4P8H
Vulnerability from github – Published: 2024-04-10 15:30 – Updated: 2024-04-10 15:30Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.
{
"affected": [],
"aliases": [
"CVE-2024-3448"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T14:15:07Z",
"severity": "MODERATE"
},
"details": "Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.\n\n",
"id": "GHSA-fg6v-9r8w-4p8h",
"modified": "2024-04-10T15:30:40Z",
"published": "2024-04-10T15:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3448"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FGCH-VC2G-G3C8
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access.
{
"affected": [],
"aliases": [
"CVE-2020-8464"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-17T21:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product\u0027s admin interface to users who would not normally have access.",
"id": "GHSA-fgch-vc2g-g3c8",
"modified": "2022-05-24T17:36:48Z",
"published": "2022-05-24T17:36:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8464"
},
{
"type": "WEB",
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000283077"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FGGG-964J-3J7H
Vulnerability from github – Published: 2026-05-29 21:31 – Updated: 2026-07-02 21:12Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "spatie/laravel-medialibrary"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48555"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T21:12:18Z",
"nvd_published_at": "2026-05-29T20:16:28Z",
"severity": "MODERATE"
},
"details": "Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.",
"id": "GHSA-fggg-964j-3j7h",
"modified": "2026-07-02T21:12:18Z",
"published": "2026-05-29T21:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48555"
},
{
"type": "WEB",
"url": "https://github.com/spatie/laravel-medialibrary/pull/3939"
},
{
"type": "WEB",
"url": "https://github.com/spatie/laravel-medialibrary/commit/608ea03703d3887c46434f5dda6af56de6346aba"
},
{
"type": "PACKAGE",
"url": "https://github.com/spatie/laravel-medialibrary"
},
{
"type": "WEB",
"url": "https://github.com/spatie/laravel-medialibrary/releases/tag/11.23.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/spatie-laravel-media-library-ssrf-via-addmediafromurl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Spatie Laravel Media Library contains a server-side request forgery vulnerability"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.